HTTP Header Checker – Debug CORS & Cache Headers

Content-Type	text/html States the media type (MIME type) of the body, and for text, its character encoding.
Cache-Control	public, max-age=86400 Tells browsers, CDNs and proxies whether a response may be stored, by whom, and for how long.
Access-Control-Allow-Origin	* Tells the browser which origin may read a cross-origin response.
Access-Control-Allow-Credentials	true Allows a cross-origin request made with cookies or HTTP authentication to read the response.
Set-Cookie	session=4f2a9c; Path=/ Stores a cookie in the browser, with attributes that control its lifetime, scope and security.
Strict-Transport-Security	max-age=86400 Tells browsers to use only HTTPS for this site, for a given time (HSTS).
x-powered-by	Express 4.19.2 Not in our reference.
ETag	W/"5e15-153d" Gives a version identifier to a response, so caches can ask “has it changed?” cheaply.
Vary	Accept-Encoding Lists the request headers that change the response, so caches keep a separate copy for each value.

Get the headers

# Response headers only (a HEAD request)
curl -sI https://example.com

# Follow redirects and show every hop
curl -sIL https://example.com

# Some servers answer HEAD differently; use GET and drop the body
curl -s -D - -o /dev/null https://example.com

HTTP header reference

Caching

Header	Sent in	What it does
Cache-Control	Both	Tells browsers, CDNs and proxies whether a response may be stored, by whom, and for how long.
ETag	Response	Gives a version identifier to a response, so caches can ask “has it changed?” cheaply.
If-None-Match	Request	Asks the server to send the resource only if its ETag differs from the ones listed.
Last-Modified	Response	Says when the resource was last changed, for revalidation and heuristic caching.
If-Modified-Since	Request	Asks for the resource only if it changed after the given date.
Expires	Response	Gives an absolute date after which the response is stale.
Age	Response	Tells how many seconds a response has spent in a cache (usually a CDN) since it was fetched from the origin.
Vary	Response	Lists the request headers that change the response, so caches keep a separate copy for each value.

CORS

Header	Sent in	What it does
Access-Control-Allow-Origin	Response	Tells the browser which origin may read a cross-origin response.
Access-Control-Allow-Credentials	Response	Allows a cross-origin request made with cookies or HTTP authentication to read the response.
Access-Control-Allow-Methods	Response	Lists the HTTP methods allowed for a cross-origin request, in answer to a preflight.
Access-Control-Allow-Headers	Response	Lists the request headers a cross-origin request may send, in answer to a preflight.
Access-Control-Expose-Headers	Response	Lets JavaScript read extra response headers from a cross-origin response.
Access-Control-Max-Age	Response	Says how many seconds a browser may cache a preflight result.
Origin	Request	Tells the server which origin (scheme, host and port) a request comes from.

Security

Header	Sent in	What it does
Content-Security-Policy	Response	Restricts where a page may load scripts, styles, images and other resources from, to contain XSS.
Strict-Transport-Security	Response	Tells browsers to use only HTTPS for this site, for a given time (HSTS).
X-Content-Type-Options	Response	Stops browsers from guessing (“sniffing”) a response’s type instead of trusting Content-Type.
X-Frame-Options	Response	Controls whether the page may be shown in a frame on another site, to prevent clickjacking.
Referrer-Policy	Response	Controls how much of the current URL is sent in the Referer header when users follow links or load resources.
Permissions-Policy	Response	Turns browser features such as camera, microphone, geolocation and payment on or off for a page and its iframes.
Cross-Origin-Opener-Policy	Response	Separates your page from cross-origin windows it opens or is opened by (COOP).
Cross-Origin-Embedder-Policy	Response	Requires every cross-origin resource a page loads to opt in to being embedded (COEP).
Cross-Origin-Resource-Policy	Response	Says which sites may load this resource with no-cors requests such as <img> and <script> (CORP).

Content and negotiation

Header	Sent in	What it does
Content-Type	Both	States the media type (MIME type) of the body, and for text, its character encoding.
Content-Disposition	Response	Tells the browser whether to show a response or download it, and under what file name.
Content-Encoding	Response	Names the compression applied to the body, such as gzip, br (Brotli) or zstd.
Accept	Request	Lists the response formats the client prefers, with optional weights.
Accept-Encoding	Request	Lists the compression formats the client can decode.
Accept-Language	Request	Lists the user’s preferred languages, from the browser or OS settings.
Content-Length	Both	Gives the size of the body in bytes.
Range	Request	Asks for only part of a resource, for resuming downloads and seeking in media.
Transfer-Encoding	Response	Says how the body is framed on an HTTP/1.1 connection; in practice, always chunked.

Authentication

Header	Sent in	What it does
Authorization	Request	Carries the client’s credentials: a bearer token, Basic username and password, or another scheme.
WWW-Authenticate	Response	Sent with 401 Unauthorized, tells the client which authentication scheme to use.

Cookies

Header	Sent in	What it does
Set-Cookie	Response	Stores a cookie in the browser, with attributes that control its lifetime, scope and security.
Cookie	Request	Sends the browser’s stored cookies for this site back to the server.

Proxies

Header	Sent in	What it does
X-Forwarded-For	Request	Carries the original client IP address through proxies and load balancers.
X-Forwarded-Proto	Request	Tells the application whether the client connected over HTTPS or HTTP, when TLS ends at a proxy.
Forwarded	Request	The standard form of the X-Forwarded-* headers: client address, protocol and host in one header.

Requests, redirects and more

Header	Sent in	What it does
Location	Response	Gives the URL to redirect to (with 3xx) or of a newly created resource (with 201).
Retry-After	Response	Tells the client how long to wait before trying again, after 429, 503 or a redirect.
User-Agent	Request	Identifies the client software: browser and version, operating system, or a bot or library name.
Host	Request	Names the domain (and port) the request is for, so one server can host many sites.
Link	Response	Expresses links in a header: preload hints, preconnects, pagination and canonical URLs.
Sec-Fetch-Site	Request	Tells the server whether a request came from the same origin, the same site, another site, or the user directly.
Clear-Site-Data	Response	Asks the browser to delete cookies, storage and cache for the site, for example on logout.
Server-Timing	Response	Reports how long the server spent on each step, shown in the browser’s network panel.

Looking for what a status line like HTTP/2 404 means? See the HTTP status codes. For the value of Content-Type, look up the MIME type of any file extension.

Frequently asked questions

How do I see the HTTP headers of a website?

Run "curl -sI https://example.com" for the response headers, or "curl -v" to see the request headers too. In a browser, open dev tools, go to the Network tab and select a request. Paste the response headers into the checker above to get each one explained.

Which security headers should every site send?

At minimum: Strict-Transport-Security (HTTPS only), X-Content-Type-Options: nosniff, a Content-Security-Policy, frame protection with CSP frame-ancestors or X-Frame-Options, and Secure, HttpOnly, SameSite cookies. Referrer-Policy is optional because browsers now default to a safe value.

Are HTTP header names case-sensitive?

No. Content-Type, content-type and CONTENT-TYPE are the same header. HTTP/2 and HTTP/3 send all names in lowercase, which is why dev tools often show them that way. Header values, on the other hand, can be case-sensitive.

What does the checker look for?

Broken CORS combinations (a wildcard origin with credentials, several origins in one header, a missing Vary: Origin), conflicting cache directives, text without a charset, cookies without Secure, HttpOnly or SameSite, duplicated headers, weak HSTS, obsolete headers like X-XSS-Protection, and missing security headers on HTML pages.

Is my data sent anywhere?

No. The headers are parsed and checked in your browser. Since headers can contain cookies and tokens, it is still a good habit to replace real session values before sharing them with anyone.

HTTP Header Checker and Reference

9 headers · status 200 · 1 error, 8 warnings