This tool runs on the server.
How it works
This tool makes a request to the URL you specify and shows you the HTTP response exactly as the server returns it: the status code, all the response headers, the redirects that happen along the way, and the cookies that are sent.
Headers define much of a site's or API's behavior: caching, security, content type, CORS, and compression. Seeing them without opening the developer tools helps debug configurations and audit a domain's security headers.
Use cases
- Audit a site's security headers (HSTS, CSP, X-Frame-Options, and the like).
- Follow a URL's redirect chain and see the final status.
- Diagnose caching problems by reviewing Cache-Control, ETag, and Expires.
- Debug an API by checking its Content-Type, CORS, and status code.
Frequently asked questions
What are HTTP response headers?
They are name-value pairs that the server sends along with the response to describe the content and how the client should handle it: data type, caching, cookies, security policies, compression, and more.
What are the most important security headers?
The most common are Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, and Referrer-Policy. Their presence and correct configuration reduce risks such as clickjacking or content injection.
Why do I see several responses for a single URL?
Because the URL redirects. Each 301, 302, 307, or 308 step is an intermediate response with its Location header, until reaching the final response. Seeing the full chain helps detect loops or unnecessary hops.
Can I also see the request headers?
The tool focuses on the server's response, which is the part that defines the site's behavior. The request headers are controlled by the client; to test variants it is best to generate the call with the cURL converter.