IPconf
← Tools

HTTP Headers

Fetch and inspect HTTP response headers for any URL.

Sends a request from our server and returns the response status plus every header it received. Useful for verifying security headers (HSTS, CSP, X-Frame-Options), checking caching configuration, tracing redirect chains, detecting which CDN or origin server is in front, and debugging content-type or CORS issues.

Headers worth paying attention to

  • server — what the origin claims to be (often spoofed or absent on hardened servers). Cloudflare-fronted sites usually show server: cloudflare.
  • strict-transport-security (HSTS) — instructs browsers to always use HTTPS for this host for the given max-age. Missing on a production HTTPS site is a finding.
  • content-security-policy (CSP) — restricts what the page can load. Long, complex headers; the strictness varies wildly between sites.
  • x-frame-options / frame-ancestors — prevent your page from being embedded in someone else's iframe (clickjacking defense).
  • cache-control / expires — caching policy. public, max-age=3600 means CDNs and browsers may cache for an hour.
  • content-type — including the charset. A wrong charset is the source of half of "weird characters" bugs.
  • access-control-allow-origin — the CORS allowlist. * = public; a specific origin = scoped; absent = browser will block cross-origin reads.

Common use cases

  • Security audit — quick check that HSTS, CSP, X-Content-Type-Options, and Referrer-Policy are set.
  • Redirect debugging — see whether http:// redirects to https://, whether www normalizes, whether trailing slashes get added.
  • CDN identification — via, x-cache, cf-ray, x-amz-cf-id all signal specific CDNs.
  • CORS troubleshooting — confirm the origin allows your domain before adding fetch calls to your frontend.

Notes

  • We send a HEAD/GET request — same as a browser. Headers behind authentication are visible only when credentials aren't required.
  • Some origins return different headers to different User-Agents or methods; this tool shows one specific request, not the universal answer.
  • To trace the full redirect chain step-by-step, use curl -sIL <url>.