--- title: "HTTP Response Header Viewer & Security Header Check" description: "Fetch a public URL, inspect final response headers and status, and see whether six common security headers are present or missing after redirects." canonical_url: "https://webaloha.co/tools/http-header-viewer/" markdown_url: "https://webaloha.co/tools/http-header-viewer.md" date_modified: "2026-07-12T00:00:00.000Z" --- # HTTP Header Viewer Last updated: Jul 12, 2026 See exactly what a server sends back. Inspect the full HTTP response headers for any URL, including status code, caching, content type, and security headers, with missing protections flagged. Refer a Client, Earn 10% or $100 Use our tools for client work? When a client needs a website, SEO, or AI-search visibility, send them our way and earn 10% or $100, whichever is greater. [How Referrals Work 🤝](https://webaloha.co/refer-a-client/) ## How the Header Viewer Works 1. **Safe fetch**, the host is validated before our server requests the URL. 2. **Follow redirects**, each hop is validated and the final URL is reported. 3. **Read headers**, the complete response header set is captured. 4. **Audit security**, key security headers are checked as present or missing. ## Why Headers Matter - **Security**, headers like HSTS and CSP defend against common attacks. - **Performance**, cache and compression headers control speed and cost. - **Correct content**, content type and charset ensure proper rendering. - **Debugging**, status codes and redirects reveal what is really happening. If your Cache-Control and compression headers are missing or misconfigured, our [website speed and performance optimization](https://webaloha.co/website-speed-performance-optimization/) service sets them up correctly so repeat visits load instantly. For broader technical fixes across headers, redirects, and crawlability, see our [SEO services](https://webaloha.co/seo-services/). ## Common HTTP Response Headers Reference A reference of the response headers you'll see most often, what each one does, and a typical or recommended value. Use it to read the output above and spot missing protections. | Header | Purpose | Typical / recommended value | | --- | --- | --- | | **Content-Type** | Declares the media type and character set of the response body. | `text/html; charset=UTF-8` | | **Cache-Control** | Controls how browsers and CDNs cache and revalidate the response. | `public, max-age=31536000, immutable` for static assets | | **Strict-Transport-Security** | Forces browsers to use HTTPS for future requests (HSTS). | `max-age=31536000; includeSubDomains` | | **Content-Security-Policy** | Restricts which sources can load scripts, styles, and other content to limit XSS. | `default-src 'self'` (tighten per site) | | **X-Content-Type-Options** | Stops browsers from MIME-sniffing a response away from its declared type. | `nosniff` | | **ETag** | A content fingerprint used to validate cached copies and return 304s. | `"33a64df5..."` (server-generated) | | **Content-Encoding** | Indicates the compression applied to the response body. | `br` (Brotli) or `gzip` | | **Server** | Names the web server software handling the request. | `nginx` (often hidden for security) | | **Set-Cookie** | Sets a cookie on the client for sessions or preferences. | `id=...; Secure; HttpOnly; SameSite=Lax` | Next steps ## HTTP Header Viewer related tools and articles Continue with the closest follow-up checks and guides based on this tool's topic, crawl intent, and optimization workflow. [![GZIP & Brotli Compression Test Tool Online](https://webaloha.co/_astro/tool-gzip-test.CGRmEkv8_ZjEi30.webp?dpl=dpl_H1MtSCmk524EGpEs7Etp4HWKr3Ti) GZIP & Brotli Compression Test ](https://webaloha.co/tools/gzip-compression-test/)[![Technical SEO Audit: What to Check and How to Fix It](https://webaloha.co/_astro/blog-technical-seo-audit.DBRDzgnk_KFMKo.webp?dpl=dpl_H1MtSCmk524EGpEs7Etp4HWKr3Ti) Technical SEO Audit Guide ](https://webaloha.co/technical-seo-audit-guide/)[![Email Address Privacy Checker Tool Online](https://webaloha.co/_astro/tool-email-privacy.C_UfTbiN_Z25vy5g.webp?dpl=dpl_H1MtSCmk524EGpEs7Etp4HWKr3Ti) Email Privacy Checker ](https://webaloha.co/tools/email-privacy-checker/)[![HTTP Status Code Checker Tool Online](https://webaloha.co/_astro/tool-http-status-checker.BhxtksKI_ZgnWae.webp?dpl=dpl_H1MtSCmk524EGpEs7Etp4HWKr3Ti) HTTP Status Code Checker ](https://webaloha.co/tools/http-status-code-checker/)[![Redirect Checker Tool Online](https://webaloha.co/_astro/tool-redirect-checker.Dypzt3q0_Z1ewhyJ.webp?dpl=dpl_H1MtSCmk524EGpEs7Etp4HWKr3Ti) Redirect Checker ](https://webaloha.co/tools/redirect-checker/)[![Security Headers Checker Tool Online](https://webaloha.co/_astro/tool-security-headers.DwX2Cogb_Z1y39R9.webp?dpl=dpl_H1MtSCmk524EGpEs7Etp4HWKr3Ti) Security Headers Checker ](https://webaloha.co/tools/security-headers-checker/) ## HTTP Header Viewer: FAQ Which response headers does the viewer show? It sends a server-side GET request to the submitted public URL, follows redirects, sorts the headers exposed by the final response, and displays their names and values along with the final URL and HTTP status. Does it show every header from every redirect hop? No. It shows the final response after redirects, not a hop-by-hop redirect trace. Use a redirect checker or a command-line client when you need the status and headers from each intermediate response. How is the security-header summary calculated? The tool checks whether six names are present: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Presence alone does not prove that a value is secure or correctly scoped. Why do these headers differ from my browser's Network panel? CDNs, geolocation, cookies, authentication, request headers, cache state, and bot handling can change a response. This check uses its own server-side user agent and has no access to your signed-in browser session. Does the result include request headers or browser-only information? No. It reports response headers returned to the checker's GET request. It does not show the request headers it sent as an audit artifact, negotiated TLS details, browser timing phases, or headers added only by browser extensions. What should I do if Server or X-Powered-By is exposed? Treat it as an information-disclosure review item, not proof of a vulnerability. If your platform allows it, remove unnecessary version details at the origin or proxy, then verify that the public response changed. Why can a check fail even when the site opens for me? The endpoint blocks private hosts and non-HTTP schemes. A public site may also time out, reject automated requests, require authentication, or return a network error from the checker's region. What data is sent when I run the viewer? The submitted URL is sent to Web Aloha's server, which requests the public page and returns its final response headers. The endpoint code does not persist the page body or result, although ordinary hosting logs may record the request. ## Want a Secure, Well-Configured Site? We set the right security headers, caching, and redirects so your site is fast, safe, and search-friendly. [Explore Web Services](https://webaloha.co/services/)