HTTP Headers
The headers your browser sent with this page, and a checker for the response headers of any public URL.
Check a URL
Your request
Headers your browser sent with this page. Headers added by our own proxy are not shown. Nothing is stored.
| Header | Value |
|---|---|
| accept | */* |
| accept-encoding | gzip, br |
| user-agent | Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected]) |
Every HTTP response starts with headers: the status code, the content type, caching rules, cookies and — increasingly — security policies. This tool requests a public URL once, reads the headers and closes the connection without downloading the body. Redirects are shown, not followed, so you can inspect each step yourself.
The security-header overview checks for the usual browser protections: HSTS (HTTPS only), Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. A missing header is not automatically a vulnerability; it means the browser falls back to its default behaviour.
Below, you also see the request headers your own browser sent to load this page.
Frequently asked questions
Why does the checker get a different result than my browser?
Servers may vary responses by user agent, language, cookies or location. The checker sends no cookies and a neutral user agent.
Which addresses can be checked?
Only public hosts on the standard ports 80 and 443. Private, internal and reserved addresses are refused before any connection is made.