HeaderInspector sends an HTTP(S) request to a URL and analyzes the response headers of the final response: HTTP status, protocol, redirects, the presence of security-relevant headers, all response headers and a security audit with warnings and recommendations.
Enter a full URL in the Target field, for example https://example.com, and press Inspect headers or the Enter key. If you omit the protocol, https:// is assumed. Redirects are followed automatically (up to 5); the analysis always refers to the final response.
The Response section shows the requested and the effective URL after redirects, the HTTP status code, the protocol (HTTP/1.1 or HTTP/2), the number of redirects, the response time and the number of received headers.
The Security headers overview lists the security-relevant headers and whether the server sends them: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy and X-XSS-Protection.
The All headers section shows the complete list of response headers of the final response — every header with its value, including duplicates such as multiple Set-Cookie entries.
The Warnings section evaluates the transport security (HTTPS), HSTS with its max-age, Content-Security-Policy (including unsafe-inline/unsafe-eval), frame protection, nosniff, Referrer-Policy, Permissions-Policy, the cross-origin policies COOP and CORP, X-XSS-Protection, information disclosure via headers such as Server or X-Powered-By, Cache-Control and the cookie flags Secure, HttpOnly and SameSite. Each finding has a status PASS, WARN, FAIL or INFO. Findings that are not PASS offer a Recommendations link that opens an overlay with concrete, prioritized measures for hardening the respective response headers.
The HTTP request is sent by this server in a way that imitates a normal browser. No third-party services are called. Your browser only sends the URL to this server; the server performs the request and returns the headers. No personal data is stored. Results are cached on the server for a few minutes.