What does the HTTP headers inspector show?
Paste a URL, hit Check, and our server walks the redirect chain one hop at a time (up to 5 hops), records each hop's status code, headers and timing, then grades the security headers on the final page A through F.
You see exactly what a browser sees on the wire: every redirect, every Set-Cookie, every Cache-Control, every CORS line. Plus a security card that tells you in plain words whether Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are set, plus a bonus point each for hiding the Server version and removing X-Powered-By.
For every missing header you get a concrete config line ready to paste into nginx, Apache, Express or your CDN.
How to use it
- Paste the full URL (e.g. `https://your-site.com`). If you skip `https://`, we add it.
- Click Check or press Enter. The server has 8 seconds per hop and 20 seconds total budget. Typical run: 200 to 800 ms.
- Read the redirect chain top to bottom: hop 1, hop 2, etc. Each shows the URL, the status code (`301`, `302`, `308`) and how long the server took to respond.
- Look at the security score card: a letter A to F plus a numeric score out of 10. Each pillar (HSTS, CSP, ...) is a row with a green check or a red cross and a one-line fix.
- Open All response headers (final hop) to see every single header grouped by Security, Caching, CORS, Server, Other. Copy the value you need with one click.
When this is useful
Seven everyday situations where you want to inspect the headers yourself:
- A new landing page is going live. Verify that the redirect chain is short (one 301 max) and that HSTS, CSP and X-Content-Type-Options are in place before marketing pushes the URL.
- Your site got a B on securityheaders.com. Use the breakdown to see exactly which two headers cost you the upgrade to A, and copy the recommended lines into nginx.
- Caching behaves weirdly. Inspect Cache-Control, ETag, Last-Modified, Vary on the final hop. If you see `Cache-Control: no-store` where you expected `max-age=3600`, you know the CDN/origin is stripping headers.
- CORS errors in the browser. Check Access-Control-Allow-Origin / -Methods / -Headers / -Credentials on the failing endpoint. The inspector shows the exact server values, no DevTools acrobatics.
- Suspicious redirect. Some marketing tools chain 4 to 5 redirects through tracking domains. The hop list shows you each step and the per-hop timing, so you can spot the slow one.
- CDN debugging. Compare headers on origin vs CDN edge. Different X-Cache, Age, Server, Via values tell you whether the CDN is serving from cache or pulling fresh.
- Compliance audit. A security checklist requires HSTS preload, no X-Powered-By and Permissions-Policy. The inspector confirms or denies each item with a copyable recommendation.