HTTP Header Analyzer
Fetch a URL or paste raw response headers to audit status, caching, compression, security headers and SEO directives in one view.
Headers to audit
Header audit
How to use the HTTP header analyzer
Enter a URL and click Fetch headers, or switch to Paste headers and paste a raw response. To copy headers yourself, open your browser's developer tools (F12), go to the Network tab, click the page request and copy the response headers. You can also run curl -I followed by the URL. The analyzer checks the status code, security headers, caching, compression and SEO directives, and flags headers that reveal your software.
Why headers matter
HTTP headers control a lot of security, performance and SEO behaviour outside the HTML. Without HSTS, browsers can be pushed onto plain HTTP. Without a caching policy, pages and files are fetched again more often than they need to be. Without compression, text files travel much larger than necessary. Headers such as Server and X-Powered-By can tell attackers which software version you run. Most fixes take one line of server or CDN configuration.
The headers that matter most
- Security: strict-transport-security, content-security-policy, x-frame-options, x-content-type-options, referrer-policy.
- Performance: cache-control, content-encoding, vary.
- SEO: x-robots-tag (indexing rules for any file type) and link (canonical and hreflang for non-HTML files).
Frequently asked questions
What is HSTS and why does it matter?
Strict-Transport-Security tells browsers to always use HTTPS for your domain. Once a browser has seen it, it refuses plain HTTP even if someone types it, which blocks downgrade attacks. Enable it on production sites once everything works on HTTPS.
Should I hide the Server header?
For hardening, yes. A value like nginx/1.18.0 tells attackers which known bugs might apply. It is not a critical issue, but it is an easy win in nginx, Apache, IIS and most CDNs.
What does X-Robots-Tag do?
It sets indexing rules in the HTTP response instead of the HTML. That makes it the only way to noindex PDFs, images and other files that cannot carry a robots meta tag.
Why do fetched headers differ from what I see in my browser?
Servers and CDNs can vary headers by location, device, cookies or compression support. Our server makes a fresh request without your cookies, so logged-in or cached responses can look different.