Complete guide to HTTP response headers. Learn to check security headers, content type, caching rules, and server info with our free header checker tool.
When your browser loads a webpage, the server sends back more than just the content. It sends HTTP headers - metadata that controls how the browser handles the response. These headers affect security, caching, content type detection, and more.
Our HTTP Headers Lookup tool shows you every header any website sends.
Key Headers to Know
- Strict-Transport-Security (HSTS) - Forces HTTPS connections. Missing HSTS can allow downgrade attacks.
- Content-Security-Policy (CSP) - Controls which scripts and resources can load. Crucial for preventing XSS attacks.
- X-Frame-Options - Prevents your site from being embedded in iframes (clickjacking protection).
- X-Content-Type-Options - Prevents browsers from MIME-sniffing content.
- Cache-Control - Tells browsers and CDNs how long to cache resources.
- Server - Reveals the web server software (Apache, Nginx, etc.)
Why Check Headers
Security audits always start with headers. Missing security headers are a common finding and easy to fix. If you're debugging caching issues, Cache-Control headers tell you immediately what's going on. And if you're implementing CORS for an API, checking response headers confirms your configuration is working.