HTTP Header Viewer

Last updated:

See exactly what a server sends back. Inspect the full HTTP response headers for any URL, including status code, caching, content type, and security headers, with missing protections flagged.

Enter a URL to view its HTTP headers:

Know a business that needs a website or SEO?

Introduce them and earn a referral reward. They work with us directly.

  • Projects: 10%, at least $100
  • Monthly services: 10% for the first six months

Refer someone now

See 36 client websites

How the Header Viewer Works

  1. Safe fetch, the host is validated before our server requests the URL.
  2. Follow redirects, each hop is validated and the final URL is reported.
  3. Read headers, the complete response header set is captured.
  4. Audit security, key security headers are checked as present or missing.

Why Headers Matter

  • Security, headers like HSTS and CSP defend against common attacks.
  • Performance, cache and compression headers control speed and cost.
  • Correct content, content type and charset ensure proper rendering.
  • Debugging, status codes and redirects reveal what is really happening.

If your Cache-Control and compression headers are missing or misconfigured, our website speed and performance optimization service sets them up correctly so repeat visits load instantly. For broader technical fixes across headers, redirects, and crawlability, see our SEO services.

Common HTTP Response Headers Reference

A reference of the response headers you'll see most often, what each one does, and a typical or recommended value. Use it to read the output above and spot missing protections.

Header Purpose Typical / recommended value
Content-TypeDeclares the media type and character set of the response body.text/html; charset=UTF-8
Cache-ControlControls how browsers and CDNs cache and revalidate the response.public, max-age=31536000, immutable for static assets
Strict-Transport-SecurityForces browsers to use HTTPS for future requests (HSTS).max-age=31536000; includeSubDomains
Content-Security-PolicyRestricts which sources can load scripts, styles, and other content to limit XSS.default-src 'self' (tighten per site)
X-Content-Type-OptionsStops browsers from MIME-sniffing a response away from its declared type.nosniff
ETagA content fingerprint used to validate cached copies and return 304s."33a64df5..." (server-generated)
Content-EncodingIndicates the compression applied to the response body.br (Brotli) or gzip
ServerNames the web server software handling the request.nginx (often hidden for security)
Set-CookieSets a cookie on the client for sessions or preferences.id=...; Secure; HttpOnly; SameSite=Lax

Next steps

HTTP Header Viewer related tools and articles

Continue with the closest follow-up checks and guides based on this tool's topic, crawl intent, and optimization workflow.

GZIP & Brotli Compression Test

Technical SEO Audit Guide

Email Privacy Checker

Core Web Vitals: What They Are and How to Fix Them

How to Check Your Website's DNS Records and What They Mean

Google Search Console Guide for Business Owners

HTTP Header Viewer: FAQ

Which response headers does the viewer show?
It sends a server-side GET request to the submitted public URL, follows redirects, sorts the headers exposed by the final response, and displays their names and values along with the final URL and HTTP status.
Does it show every header from every redirect hop?
No. It shows the final response after redirects, not a hop-by-hop redirect trace. Use a redirect checker or a command-line client when you need the status and headers from each intermediate response.
How is the security-header summary calculated?
The tool checks whether six names are present: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Presence alone does not prove that a value is secure or correctly scoped.
Why do these headers differ from my browser's Network panel?
CDNs, geolocation, cookies, authentication, request headers, cache state, and bot handling can change a response. This check uses its own server-side user agent and has no access to your signed-in browser session.
Does the result include request headers or browser-only information?
No. It reports response headers returned to the checker's GET request. It does not show the request headers it sent as an audit artifact, negotiated TLS details, browser timing phases, or headers added only by browser extensions.
What should I do if Server or X-Powered-By is exposed?
Treat it as an information-disclosure review item, not proof of a vulnerability. If your platform allows it, remove unnecessary version details at the origin or proxy, then verify that the public response changed.
Why can a check fail even when the site opens for me?
The endpoint blocks private hosts and non-HTTP schemes. A public site may also time out, reject automated requests, require authentication, or return a network error from the checker's region.
What data is sent when I run the viewer?
The submitted URL is sent to Web Aloha's server, which requests the public page and returns its final response headers. The endpoint code does not persist the page body or result, although ordinary hosting logs may record the request.