How to Check HTTP Response Headers of Any Website
HTTP response headers reveal how a server is configured — its cache policy, security posture, technology stack and more. Here are several ways to inspect them.
ProfitTool Team
Security & Dev
Why Response Headers Matter
HTTP response headers are metadata sent by a server alongside every response. They control caching, compression, content type, security policies, cookies, CORS, and more. Inspecting them helps you:
- Verify security headers are set correctly
- Debug caching issues
- Check whether compression is enabled
- Confirm redirects are working
- Identify the server technology
Method 1: Browser Developer Tools
The fastest approach for any website you can visit:
- Open DevTools (F12 or right-click → Inspect)
- Go to the Network tab
- Load or refresh the page
- Click the main document request (usually the first row)
- Click the Headers tab → scroll to Response Headers
Method 2: curl
From a terminal, -I sends a HEAD request (headers only) and -L follows redirects:
curl -I -L https://example.comTo see all headers including on redirects:
curl -v https://example.com 2>&1 | grep "^<"Method 3: Online Tools
Online header checkers are useful when you want to check from outside your network or share results with a colleague. They work by proxying the request through a neutral server and displaying all response headers.
Method 4: httpie
httpie is a friendlier curl alternative:
http --headers GET https://example.comKey Headers to Look For
| Header | What to check |
|---|---|
Strict-Transport-Security | Present? max-age >= 31536000? |
Content-Security-Policy | Present? No unsafe-inline? |
X-Content-Type-Options | Should be nosniff |
Cache-Control | Is static content cached? Is HTML no-store? |
Server | Version info disclosed? Consider removing or obscuring. |
Content-Encoding | Is gzip/br compression enabled? |
Use our HTTP Response Headers Viewer to inspect any public URL's headers instantly.
ProfitTool Team
Security & DevWritten and maintained by the ProfitTool team. Where an article references a ProfitTool utility, the behaviour described is the behaviour of the tool on this site — you can open it and check the output yourself.
More from the Knowledge Hub
What Is CORS and How Does It Work?
CORS (Cross-Origin Resource Sharing) controls which websites can make requests to your API. This guide explains the same-origin policy, CORS headers, preflight requests and common misconfigurations.
Developer ToolsBase64 Encoding Explained: What It Is and How It Works
Base64 turns binary into 64 safe ASCII characters, at a 33% size cost. How the encoding works, what padding is for, and how Base64URL differs.
Developer ToolsDemystifying Cron Schedules: How to Generate and Debug Linux Crontabs with AI
A complete engineer's reference to cron expressions. Learn crontab syntax, special strings (@daily, @reboot), timezones, and how to generate schedule expressions with AI.