HTTP Header Inspector
Enter a URL to inspect its HTTP headers. This tool will display all headers and highlight common security headers like CORS and CSP.
About this tool
This tool directly fetches the URL you provide using a HEAD request to retrieve its HTTP headers. It then displays all returned headers and specifically highlights common security-related headers such as:
- CORS (Cross-Origin Resource Sharing) Headers: These headers (e.g.,
Access-Control-Allow-Origin) control how web browsers allow resources on a web page to be requested from another domain outside the domain from which the first resource was served. - CSP (Content Security Policy) Headers: These headers (e.g.,
Content-Security-Policy) are an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. - X-Frame-Options Header: This header (
X-Frame-Options) provides clickjacking protection by indicating whether a browser should be allowed to render a page in a<frame>,<iframe>,<embed>or<object>.
Understanding these headers is crucial for web developers and security analysts to ensure web applications are configured securely and function correctly across different origins.