Tools / Network
HTTP Headers Analyzer
Inspect HTTP response headers, security headers and redirect chain for any URL. Reads HTTP headers, the full redirect chain and security policies (HSTS, CSP, X-Frame-Options) in one request — ideal for SEO audits, CDN debugging and security hardening.
The hidden metadata layer of every request
HTTP headers are metadata key/value pairs exchanged between browser and server. Request headers (User-Agent, Accept, Cookie) tell the server who the client is and what it expects; response headers (Content-Type, Cache-Control, Set-Cookie) describe what the server returned and how the browser should handle it. This tool only reads the response headers and redirect chain — it never downloads the body.
Security headers are the backbone of a modern web stack. HSTS locks the browser into HTTPS, CSP blocks XSS, X-Frame-Options prevents clickjacking. Missing these headers leaves an open door for attackers. For enterprise hardening see our server security plans.
About HTTP headers
HSTS tells the browser "never reach this origin over plain HTTP again". After the first HTTPS visit, the browser auto-upgrades every request to HTTPS for the max-age duration, blocking SSL-stripping attacks. Recommended value: max-age=63072000; includeSubDomains; preload.
CSP whitelists which origins may load scripts, styles, images or iframes. It's the strongest defence against XSS — it blocks inline scripts and permits only approved domains. Safe inline scripts are supported via nonces or hashes.
CORS (Cross-Origin Resource Sharing) controls whether JavaScript on one origin may call an API on another. Access-Control-Allow-Origin lists which origins may access it, Access-Control-Allow-Methods which HTTP verbs are accepted. "Access-Control-Allow-Origin: *" is fine for public APIs but must never appear on authenticated endpoints.
X-Powered-By (and Server) headers leak the exact software and version your server runs (e.g. PHP/8.1.2, Express). Attackers use that info to target known CVEs. Disable it with app.disable("x-powered-by") in Express or server_tokens off; in nginx.