HTTP headers
HTTP headers viewer — see any URL's response headers
Paste any URL and get the full set of response headers plus a security-header grade (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Free, instant, no login.
What this HTTP headers viewer does
Every HTTP response comes with a set of headers — key-value pairs the server sends before the page body. They tell your browser how to handle the response: how long to cache it, whether to allow scripts, where to redirect, what content type the body is, and so on. Some headers are security-critical (CSP, HSTS, X-Frame-Options); others leak information about the server (Server, X-Powered-By) and should be removed. This tool fetches any public URL, dumps the full response header set, and grades the security headers on a 0–100 scale.
Fetching headers…
Use a full URL starting with http:// or https://. Private IPs and localhost are blocked.
How the security-header grade works
The grade is a 0–100 score built from six weighted security headers. Content-Security-Policy is worth 25 points and is the most commonly missed; Strict-Transport-Security is worth 20; X-Frame-Options is worth 15; X-Content-Type-Options and Referrer-Policy and Permissions-Policy are worth 10 each. A+ means 95+, A is 85–94, B is 70–84, C is 55–69, D is 40–54, and F is below 40. The grade also surfaces any Server, X-Powered-By, or version-leaking headers — these are not scored against you, but they tell an attacker what stack you run, and most security guides recommend stripping them.
Frequently asked questions
What are HTTP response headers?
HTTP response headers are key-value pairs the server sends back with every page load, before the page content. They tell your browser how to handle the response: how long to cache it, whether to allow scripts, where to redirect, what content type the body is, and so on.
What is the Content-Security-Policy header?
Content-Security-Policy (CSP) is a header that tells the browser which sources of scripts, styles, images, and connections are allowed to load on the page. A well-configured CSP prevents most XSS attacks because even if an attacker injects a script tag, the browser refuses to load the source. A missing or weak CSP is one of the most common security gaps on production sites.
What is Strict-Transport-Security (HSTS)?
Strict-Transport-Security (HSTS) is a header that tells the browser to always use HTTPS for this domain, even if the user types http:// or follows an http:// link. The header includes a max-age in seconds (commonly 31536000, which is one year) and an optional includeSubDomains flag. HSTS prevents downgrade attacks and cookie theft.
Why does my site get a bad grade?
Most production sites miss one or more of the high-weight security headers. The score is a rough guide — a site with no CSP is genuinely at higher risk for XSS, but a site with a strong CSP that breaks half the page is also not safe.
Is this tool safe to use on any URL?
You can use it on any public http:// or https:// URL. Private IPs, localhost, and .local / .internal hostnames are blocked to prevent the tool from being used to scan internal infrastructure. The tool only reads response headers — it does not execute the page, does not load scripts, and does not interact with the page in any way your browser would not if you visited the URL directly.