HTTP Headers Checker

What the HTTP Headers Checker checks

HTTP response headers are the metadata a server sends before the page itself. They carry the status code, the content type, caching rules, cookies, compression, security policies and often details about the server software. Browsers act on them but never show them unless you open the developer tools.

This checker requests the URL you enter and lists every response header it receives. Set-Cookie headers are shown by cookie name only, so session values never appear on screen. On top of the raw list, it checks whether the HTML is compressed, which HTTP version the server supports, whether headers such as Server and X-Powered-By reveal software versions, and whether the CORS headers let other origins read the response.

Why it matters

Headers explain many problems that are invisible in the page: a CDN that is not caching, a cookie missing its flags, a response served without compression, or a header your configuration should have set but did not. Reading them directly is often the fastest way to confirm what a server, proxy or CDN is actually doing, as opposed to what its configuration says.

Some headers give information away. A Server: Apache/2.4.41 or X-Powered-By: PHP/7.4.3 header tells anyone which exact versions you run, which makes it easy to match the site against known vulnerabilities; see version disclosure. A CORS policy that reflects any origin and allows credentials can let other sites read responses meant for your logged-in users (CORS headers).

How to fix common problems

Remove version details from identification headers. In nginx, set server_tokens off;. In Apache, use ServerTokens Prod and ServerSignature Off. In PHP, set expose_php = Off in php.ini to drop X-Powered-By. Frameworks may add their own header; in Express, call app.disable('x-powered-by').

Enable Brotli or gzip for text responses and serve the site over HTTP/2 or HTTP/3; our text compression guide shows the server settings. Send CORS headers only on endpoints that need them, and list the exact origins you allow instead of echoing whatever origin the request sends.

Then add the security headers browsers rely on, such as HSTS, Content-Security-Policy and Referrer-Policy. The Security Headers Generator writes them for nginx, Apache and _headers files, and the Security Headers Checker grades the result. The full PerfoMetrix audit checks headers alongside TLS, cookies and 170+ other checks.

Questions

Why are cookie values hidden?

Cookies often hold session identifiers. Showing them would display a working login token to anyone viewing the result, so the tool lists cookie names and leaves the values out.

Why do I see different headers in my browser?

Your browser sends its own cookies, language and cache headers, and may reach a different CDN location. Logged-in sessions, A/B tests and bot rules can change the response too.

Is hiding the Server header real security?

It does not fix a vulnerable version, so keep your software updated. It removes an easy signal that automated scanners use to pick targets, and it costs nothing.