Softonic

HTTP Header Checker

Step 1 / 3 Check headers

A page that caches wrong, a CORS request that fails, an API that returns the wrong content type, almost every one of those bugs is diagnosable from the response headers. Enter a URL and this tool sends a GET request, then displays the HTTP status code and every response header the server sends back, so you can check caching, CORS, compression and security settings in seconds.

How to inspect response headers

  1. 1

    Enter a URL

    Any public HTTP or HTTPS URL.

  2. 2

    Run the request

    The tool sends a GET request and shows the HTTP status code of the first response.

  3. 3

    Review the response headers

    Every header the server sent is listed with its raw value, ready to copy or compare.

Headers that matter most

HTTP responses carry anywhere from a handful to 30+ headers. A short list covers the majority of real-world debugging scenarios.

Caching

Header What to check
Cache-Control public vs private, max-age value
ETag Present for conditional GET
Last-Modified Present for If-Modified-Since checks
Age Object age at CDN (seconds)
Vary Cache key inputs, Accept-Encoding, Accept-Language

Compression

Header Meaning
Content-Encoding gzip, br, zstd, the body is compressed
Content-Length Compressed size; uncompressed size is separate

CORS

Header Purpose
Access-Control-Allow-Origin Which origins can read the response
Access-Control-Allow-Methods Methods allowed for cross-origin requests
Access-Control-Allow-Credentials true to send cookies cross-origin
Access-Control-Expose-Headers Headers JS code can read
Access-Control-Max-Age Cache duration for preflight response

Security

Header Target threat
Strict-Transport-Security Protocol downgrade
Content-Security-Policy XSS, clickjacking
X-Frame-Options Clickjacking (legacy)
Referrer-Policy Data leakage via Referer
X-Content-Type-Options: nosniff MIME sniffing

Redirects

This checker sends a single GET request and stops at the first response, so the headers you see belong to the first hop in the chain. If the server answers with a 3xx status, the Location header points to the next hop; open that URL in the checker to inspect the following response.

Frequently Asked Questions

Browsers sometimes hide “forbidden” or hop-by-hop headers for security reasons. This checker uses an HTTP client that shows everything the server actually sent, including headers the browser filtered out.

No, this version always sends a plain GET with a standard user agent. If you need custom headers, methods or a request body, use the HTTP request tester instead.

No. It deliberately stops at the first response so you can see exactly what that URL returned. If the server redirects, the Location header points to the next hop; enter that URL to inspect the following response.

Some servers send the body in chunks and omit Content-Length, which is normal when Transfer-Encoding: chunked is present. The status code and remaining headers are still reliable.

Related Tools

What Is My IP

See the IP address this server received for your request, its IPv4 or IPv6 family, and an approximate country when local GeoIP data is available.

IP Address Lookup

Look up any public IPv4 or IPv6 address for approximate country, region, city, coordinates, ISP, ASN, organization and timezone.

Speed Test

Run a fast, free, browser-based internet speed test. Measure your download speed in Mbps plus round-trip latency and jitter, and see whether your connection is ready for 4K streaming, gaming and video calls, no app, no signup.

WHOIS Lookup

Look up public WHOIS registration data for a domain: registrar, nameservers, status codes and expiry dates.

DNS Lookup

Query the A, AAAA, MX, TXT, NS, CNAME and SOA records of any domain without opening a terminal.

Reverse DNS Lookup

Look up the PTR record for an IPv4 or IPv6 address. Useful for mail-server debugging, log analysis and spam-filter investigations.

Tool available in other languages