Logo
HTTP headers·security · caching · raw

What is your server actually sending?

Fetch the raw HTTP response headers for any URL, grouped into security, caching and general — with a security-header score at a glance.

Live fetch
Security header score
Enter a URL to fetch its HTTP headers.
Try github.com, cloudflare.com, or your own site.
What you get

Headers, organized.

We fetch the live response and sort every header into a group that makes sense, instead of dumping raw text.

Security header score

HSTS, CSP, X-Frame-Options and more are checked automatically, and scored so you can see hardening gaps instantly.

Live HTTP fetch

We request the page directly with a standard browser user agent and read the exact headers it returns, redirects included.

Grouped or raw view

Switch between a categorized view (security, caching, general) and the raw header list exactly as the server sent it.

One-click copy

Copy any individual header value — handy for debugging CSP policies or comparing cache behavior across environments.

Stop second-guessing.

Find your domain in the next 30 seconds.

Free forever. No login required. 1,100+ TLDs in one query — plus AI suggestions and the premium marketplace.

Start checking now Learn more
1,147
TLDs
200ms
Avg lookup
100
Suggestions/query
FAQ

HTTP headers, explained.

Headers like Content-Security-Policy and X-Frame-Options tell the browser how to defend the page against attacks like clickjacking and cross-site scripting. Missing them doesn't guarantee a vulnerability, but it removes a layer of defense browsers offer for free.
It tells browsers to only ever load the site over HTTPS for a set duration, even if a user types or clicks an http:// link. This prevents a class of downgrade attacks on the very first request.
Cache-Control, ETag, Expires and similar headers control whether browsers and CDNs store a copy of the response and for how long. Misconfigured caching headers are a common cause of users seeing stale content after a deploy.
No — not every header applies to every site. A static marketing page has different needs than a banking dashboard. Use the score as a prompt to double-check intent, not as a strict pass/fail grade.
It requests the page with a standard desktop browser user agent, following redirects, so in most cases yes — though servers that vary responses by cookie, geography, or A/B test may show something slightly different to real visitors.