HTTP Headers

Bulk HTTP response headers

Issue an HTTPS request against any URL and see the response status plus a curated set of the headers it actually returned — server, content type, caching policy and three of the most-used security headers. Submit up to 100 URLs in one bulk check and the results land in a single side-by-side table you can export.

What this tool actually does

Per submitted URL we do a single full GET (via cURL) with a 10-second timeout, following up to 5 redirects, and capture every response header along the way. We don't read the body for you, but we do download it — most servers won't emit the full header set in response to a HEAD. Our user-agent is YouMonit/1.0.

Input accepted

• https://example.com/path — checked as is.
• example.com — auto-prefixed with http://; if the server immediately upgrades to HTTPS, we'll follow the redirect and the URL column shows the final URL after the upgrade.
• Non-default ports are fine (https://example.com:8443/).

What this tool returns

URL

Final URL after redirects — not the one you typed. A frequent source of "why does this differ?" answers: a 301 from www to apex, an HTTP→HTTPS upgrade, or a CDN rewrite.

Status

HTTP status code of the final response — 200, 301/302 are folded into a follow, 404, 500 etc. as returned.

Server

Value of the Server header — often nginx, cloudflare, Microsoft-IIS/10.0. Empty when the origin strips it (common with hardened deployments).

Content-Type

MIME type plus optional charset — e.g. text/html; charset=UTF-8, application/json, image/webp.

Cache-Control

Caching directives — public, max-age=3600, no-store, private, must-revalidate. The first line of defence for understanding why your CDN does or doesn't cache something.

Strict-Transport-Security

HSTS policy — max-age in seconds plus optional includeSubDomains and preload. Visible on the single-URL detail card.

X-Frame-Options

Legacy clickjacking guard — DENY / SAMEORIGIN. Modern replacement is frame-ancestors inside CSP. Visible on the single-URL detail card.

Content-Security-Policy

Inline CSP policy. Truncated at 200 characters with a trailing … — CSP policies routinely run a kilobyte and that doesn't fit a table cell. Visible on the single-URL detail card.

Time

Total request time in milliseconds — DNS, TCP, TLS, redirects and body download. Not a pure header-time number.

Why look at HTTP headers in bulk?

Migration verification

After switching hosting, CDN or load balancer, bulk-check every URL you care about and confirm the new Server column matches what you expect.

Cache policy audit

Sort by Cache-Control and find the URLs that forgot to set it (or set it wrong). Static assets that return no-cache are quiet performance killers.

Security-headers spot check

Quick sweep across a portfolio: every public URL should be returning HSTS, and ideally a real CSP. This isn't a grading tool — but it does surface the bare presence / absence in a single pass.

Status & redirect mapping

Find unintended 302s, broken 404s and accidental HTTP→HTTPS→HTTP loops. The final URL column tells you where each input ended up.

Surveying a third party

Cheap due-diligence pass — what server, what CDN, what caching, what security posture, for any set of public URLs.

What this tool does NOT do

• Doesn't show the body. We surface headers and status only — not the HTML, JSON or image we just downloaded.
• Doesn't show every header. The result table is the curated set listed above. Headers like Cookie, Set-Cookie, X-Powered-By, X-Request-Id and friends aren't surfaced.
• Doesn't show the redirect chain. If you visit one URL and get redirected through three others, only the final response is rendered.
• Doesn't grade security headers. Presence/absence only — no SecurityHeaders.com-style A+ scorecard.
• Doesn't break time into phases. No DNS / TCP / TLS / TTFB split — only total request time. See Web speed test for a richer timing breakdown.
• Doesn't verify TLS. We disable cert verification so the tool keeps working against expired / self-signed / mis-issued certs. Use SSL / TLS checker for cert details.
• Truncates CSP at 200 characters. View the full policy via browser devtools when you need every byte.

Bulk mode

Drop up to 100 URLs in the textarea, one per line. Mixed schemes and ports are fine. Each row is fetched in sequence and the result is exportable to CSV / JSON / YAML / XML. Useful for quarterly hygiene sweeps, pre-launch checklists, post-migration verifications, and third-party reviews.

Common reasons a check fails

• Timeout — host didn't respond within 10 seconds. Slow upstream, firewalled, or genuinely down.
• Could not resolve host — DNS failure (typo, no public A/AAAA).
• No response — connection accepted but nothing came back.
• Too many redirects — five hops weren't enough, usually a redirect loop. The tool gives up and reports the error.
• Invalid URL — input didn't pass URL validation after auto-prefixing http://.

Best practices we'd back

• Cache static assets aggressively (max-age with a long TTL + content-hash fingerprinting); never no-store for shared CSS/JS/images.
• Ship HSTS once you're confident the site is HTTPS-only — start short, then long, then consider preload.
• Prefer CSP frame-ancestors over X-Frame-Options, but ship both for legacy browsers.
• Don't leak versions through Server / X-Powered-By — set them empty at the edge.
• Audit redirect chains regularly — a 301 chain wastes round trips and search-engine crawl budget.

Related tools

Pair this with the SSL / TLS checker (cert details on the same URLs), Web speed test (TTFB / total / page weight breakdown), DNS records lookup (confirm where the hostname is pointing), and domain & IP lookup (GeoIP / ASN on the origin IP).

Get started

Paste one or more URLs in the form above. Single submissions render as a detail card with every captured header; bulk submissions as a side-by-side table you can export.