We use cookies.This website uses essential cookies to operate core features. With your consent, we also use analytics cookies to understand traffic and improve the service. For more details, see our .
We use cookies.This website uses essential cookies to operate core features. With your consent, we also use analytics cookies to understand traffic and improve the service. For more details, see our .
Was this tool helpful to use?
Your feedback helps us make it better
Online tool to parse HTTP request and response headers for websites or APIs, helping developers debug and optimize network communications.
Overview
Understand what the tool solves, how it works, and the boundaries of its data.
Enter one website URL to retrieve its final HTTP status and review a selected set of response headers. HTTP status codes describe the result of a request, while response fields carry metadata about the response. The checker presents ten chosen fields rather than a complete dump of request and response traffic.
The selected fields include security-related entries such as Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and X-XSS-Protection, along with Cache-Control, Content-Encoding, and Server. Some values are copied as returned; the page also labels missing entries and provides a heuristic score.
The security score is a quick heuristic based on a particular set of checks and penalties for selected missing fields and warnings. It is not a certification, a complete security audit, or a measure of every risk in a website. The list of fields is intentionally limited, so absence from the list does not mean a field was absent from the actual response.
A present header is not automatically configured correctly. Review its full value and the application's needs. For example, a policy can be too broad or too restrictive even when the field is present.
HSTS tells browsers to use HTTPS under its policy; Content-Security-Policy constrains permitted sources and actions; X-Frame-Options relates to framing behavior; Referrer-Policy controls referrer information. Cache-Control communicates caching directives, and Content-Encoding identifies a content coding. Interpret each value in the context of the site and current browser support.
Guide
Follow the workflow and verify inputs and outputs with practical examples.
Provide a website address. If you omit the scheme, the checker treats it as HTTPS; HTTP and HTTPS addresses are accepted.
Review the final status code and displayed URL along with the selected header values.
Security, performance, and other information are grouped separately. Copy a value if you need to compare it with your server configuration.
Use the field name and returned value to inspect the relevant application or proxy settings. Check the site's own response if results seem unexpected.
Use cases
See how the tool fits into real work and everyday tasks.
Compare the final URL and status with the address you entered when investigating a route that behaves unexpectedly.
Check whether expected response policies appear after a configuration change, then verify their values in the site's own environment.
Look at Cache-Control and Content-Encoding as clues about the response, then use browser or server diagnostics for a fuller investigation.
Q&A
Find concise answers to common questions and confusing cases.
No. It checks a single URL and displays ten selected response fields with the final status and URL. It does not show the full request headers or every returned response field.
No. The score is a limited heuristic and cannot certify security or replace a broader assessment.
Responses can vary by URL, redirects, time, network path, and request context. Compare against the exact resource and configuration you are investigating.
Not by itself. Whether a field is appropriate depends on the site, its deployment, and the field's purpose.
Notes
Review scope, result limitations, and important precautions before use.
For security decisions, examine the complete application configuration and test the actual behavior. A header check can help locate a question to investigate, but it cannot determine whether a site is safe or whether a particular policy is suitable.
Related
Discover related tools, collections, and available API capabilities.