MyIPInfo
Tools / HTTP Headers

HTTP Headers

Fetch and inspect HTTP response headers for any URL. Check security headers, caching, redirects, and server info.

Every time your browser opens a webpage, the server sends back a set of "headers" alongside the page — invisible labels telling the browser things like "cache this for an hour", "this is a secure connection", or "redirect to a different address". This tool shows those headers, so you can see what a website is telling your browser without inspecting the page yourself.

The most interesting headers, in plain English

  • server — what the website's server claims to be (Apache, nginx, cloudflare, …). Often the first clue about who hosts the site.
  • strict-transport-security — if present, the site forces your browser to use HTTPS for every future visit. A sign the site takes security seriously.
  • content-security-policy — restricts which scripts and resources the page is allowed to load. Designed to limit damage if something on the page tries to be malicious.
  • cache-control — tells your browser whether and how long it may store the page. Affects how fast a return visit loads.
  • set-cookie — cookies the site wants to store on your device. Read this if you're curious what a site is tracking.
  • location (with status 301 or 302) — the address the server is redirecting you to.

When this is useful

  • Curious what cookies a site sets — the set-cookie headers show them before they end up on your device.
  • Checking whether a site uses HTTPS properly — look for strict-transport-security and a 301 redirect from http:// to https://.
  • Spotting which CDN a site uses — headers like cf-ray (Cloudflare), x-amz-cf-id (CloudFront), x-served-by (Fastly) give it away.
  • Following a redirect — if a short URL or tracking link goes somewhere unexpected, this tool shows the destination without you having to actually visit it.

Note

We fetch the URL once from our server and report what we got back. Pages that show different content to different visitors (geolocation, device-targeted, logged-in) may serve different headers to us than they would to you.