About this tool
Enter a URL to see the headers the server returns. The ones usually worth checking are Cache-Control and ETag for caching, Content-Type and Content-Encoding for content handling, and Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, and Referrer-Policy for security. A Content-Type without a charset is a common cause of garbled non-Latin text. Cache-Control that is too permissive leaves stale content after a deploy; too strict and you lose caching entirely. Headers carrying session state are stripped before the response is returned, so someone else's site session is never surfaced on this page.
Limits and notes
The server issues one GET request and reports the headers. Headers carrying session state, such as Set-Cookie, are removed and never displayed or stored. At most 10 redirects are followed, each revalidated before it is taken.
How your input is handled
The domain or URL you enter is sent to our server, where an isolated process contacts the host on your behalf. Nothing you submit is stored or written to an analytics event, no cookies or authorization headers are forwarded, and the target's JavaScript is never executed. The server may only reach publicly routable internet addresses; private ranges, loopback, and cloud metadata addresses are refused.