Trexmi
Network Ready

HTTP Header Checker

Inspect HTTP response headers, caching, content metadata, CORS, and common security headers for a public URL.

live response header request HEAD or GET request redirect following security header review
Only public HTTP/HTTPS URLs are requested. Header presence alone does not prove that a security or caching policy is correct.
INPUT URL to inspect *
0 chars0 words0 lines

Tool settings

Ctrl / ⌘ + Enter
HTTP header analysis Visual response summary, security and caching review, complete headers, and raw JSON.
About the tool

What HTTP Header Checker does

HTTP Header Checker requests a public URL and displays the HTTP response headers returned to the Trexmi server. Use HTTP Header Checker to inspect response status, content type, caching directives, server metadata, redirects, CORS headers, and common browser security headers without reading a raw header dump first.

HTTP response headers carry metadata that controls browser behavior, caching, content negotiation, security policies, cross-origin requests, redirects, and diagnostics. The presence of a header is useful evidence, but every value still needs to be interpreted in the context of the website or API.

HTTP Header Checker visual report with response status security headers caching and complete headers
HTTP Header Checker turns response headers into a readable network and security report.

How to use

  1. Enter the URL. Use an absolute public HTTP or HTTPS URL.
  2. Choose the request method. HEAD usually retrieves headers without downloading the full resource. GET can help when a server handles HEAD incorrectly.
  3. Choose redirect behavior. Follow redirects to inspect the final response or disable the option to inspect the first response directly.
  4. Run HTTP Header Checker. Trexmi safely requests the URL from the server.
  5. Review the visual result. Check status, timing, content type, caching, security headers, and the complete response header list.
Built for the task

Why use HTTP Header Checker?

Focused controls, predictable output, and a workflow designed around this exact transformation.

01

Read headers visually

Inspect important response metadata without searching through an unstructured header block.

02

Review security headers

See whether CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and X-Frame-Options are returned.

03

Inspect caching

Review Cache-Control, Expires, ETag, Last-Modified, Age, and Vary when they are present.

04

See the complete response

Open every response header or Raw JSON when you need precise technical detail.

Useful answers

Questions about HTTP Header Checker

Practical details about input, output, privacy, limits, and the best way to use this tool.

01 What does an HTTP Header Checker do?

It sends an HTTP request to a URL and reports the response headers returned by the server, proxy, CDN, or application.

02 Should I use HEAD or GET?

HEAD is efficient because it normally returns headers without a response body. Some servers implement HEAD differently, so GET can be useful when the results look incomplete.

03 Does a missing security header always mean the site is insecure?

No. Header requirements depend on the application. The checker highlights common headers for review rather than claiming that every missing header is automatically a vulnerability.

04 Why can the headers differ from my browser?

CDNs, cookies, authentication, bot detection, geography, cache state, and request headers can cause different clients to receive different responses.

05 Can HTTP Header Checker test internal URLs?

No. Trexmi uses safe server-side HTTP handling and is intended for public HTTP and HTTPS destinations.

Learn HTTP & Network Debugging

Read the HTTP Headers Guide

Connect DNS, redirects, HTTP headers, requests, responses, caching, security, and practical web diagnostics.

  • Requests and response headers
  • Redirect and cache diagnostics
  • Security and API debugging
Read guide Practical explanations and examples

How HTTP Header Checker works

The HTTP Header Checker sends a controlled server-side HTTP request and records the status code, response time, and returned headers. A response can pass through a CDN, reverse proxy, load balancer, web server, and application before it reaches the checker, so the headers represent the effective public response seen by that request.

Use HTTP Status Code Lookup to interpret an unfamiliar status and Redirect Chain Checker for deeper hop-by-hop redirect diagnostics.

Common security headers

Content-Security-Policy can restrict which sources are allowed to load scripts, styles, images, frames, and other resources. Strict-Transport-Security tells compatible browsers to use HTTPS for a defined period. X-Content-Type-Options can disable MIME sniffing, Referrer-Policy controls referrer information, Permissions-Policy can limit browser features, and X-Frame-Options is a legacy framing control still seen on many sites.

A good security policy is more important than simply having a header. For example, an overly permissive CSP may provide little protection even though the header exists. Review values carefully and test changes before deploying them.

Caching and content headers

Cache-Control is the primary modern mechanism for HTTP cache behavior. ETag and Last-Modified support conditional requests, while Age can indicate that a cached response was served by an intermediary. Vary tells caches which request headers can change the representation. Content-Type describes the media type and optional character encoding.

For standards-level behavior, review the HTTP Semantics specification and the MDN HTTP headers reference.

CORS response headers

Headers beginning with Access-Control- participate in Cross-Origin Resource Sharing. They tell browsers which origins, methods, request headers, or credentials are allowed. Build a proposed response policy with CORS Header Generator, then verify the deployed headers here.

Use CSP Policy Builder for browser resource restrictions, HTTP Status Code Lookup for protocol meanings, and Redirect Chain Checker when a URL moves through several locations.

HTTP Header Checker summary

HTTP Header Checker is most useful when you compare the returned metadata with the behavior you expect. Check the response code first, then content, caching, security, redirect, and CORS headers. A missing or unexpected value is a signal to investigate the server, CDN, proxy, or application configuration rather than an automatic diagnosis by itself.