Free Headers Sniffer
Fetch a public website’s HTTP response headers and review available security-header observations.
Check HTTP Headers
Enter a URL to analyze its HTTP headers. This tool will show you all request and response headers, security headers, and provide recommendations for improving security.
How to use this tool
Follow these steps to get observations you can interpret and act on.
Enter the public page URL
Use the HTTP or HTTPS page you want to inspect. Avoid authenticated links and URLs containing private tokens.
Fetch the headers
Run the check and wait for the server response. Switch between the response, security and raw views for the details you need.
Interpret policies in context
Review each header’s value and scope, then verify changes against the actual application and other important URLs.
How the HTTP headers sniffer works
The headers checker sends your public URL to this application’s server, which fetches the target and returns response-header data. You can review a readable list, selected security-header checks and raw header text without relying on browser cross-origin response access.
Understanding your results
- Response headers can describe caching, content type, transport policy and browser security controls. Presence alone does not establish a secure application.
- The response is obtained from this application server’s route and request context. Your signed-in browser or another region may receive different headers.
- Selected security-header checks are a limited configuration review. They do not test every policy directive or replace a complete security assessment.
Privacy & important limitations
- The application server receives the URL and contacts the target. Your browser’s target-site login session is not the request context used by this check.
- Inspect public pages only. Review raw or copied headers before sharing them, since a target can include identifiers or other response-specific data.
Security-header observations cover the fetched response and selected checks. They are not a complete application security assessment.
Frequently asked questions
Why do these headers differ from my browser developer tools?
Servers can vary responses by cookies, user agent, location, redirects or request method. This tool uses a separate server-side request.
Does a missing header always mean a vulnerability?
No. The relevance depends on the application and threat being addressed. Read the policy details and confirm an appropriate configuration for the site.