HTTP Header Inspector

The HTTP Header Inspector shows all HTTP response headers returned by any URL. It highlights security-related headers and identifies missing recommended headers.

Security Headers Checked

• Strict-Transport-Security (HSTS) - Forces HTTPS connections
• Content-Security-Policy (CSP) - Controls which resources can load
• X-Content-Type-Options - Prevents MIME type sniffing
• X-Frame-Options - Prevents clickjacking
• Referrer-Policy - Controls what referrer info is sent
• Permissions-Policy - Controls browser feature access

Other Headers

The tool also shows caching headers (Cache-Control, ETag, Last-Modified), server information, content encoding, and any custom headers. This is useful for debugging CDN configurations, caching behavior, and server settings.

Resources

• Mozilla Observatory for comprehensive security header analysis
• Security Headers for a quick security header score
• OWASP Secure Headers Project for best practices