HTTP Headers Checker

1. Enter URL: Type or paste any website URL in the input field above (e.g., https://example.com)
2. Click Check Headers: Press the "Check Headers" button to analyze the website
3. View Results: The tool will display:
   • Complete list of HTTP response headers
   • Security header analysis with recommendations
   • Status codes and server information
4. Security Analysis: Check which security headers are present or missing for better website protection
5. API Access: Use our API endpoint for programmatic access (see API documentation below)

Non-Standard Headers

In the above table there are a significant number of HTTP Headers that have "X-" appended to the header. This denotes the header is non-standard. It is not a part of the HTTP standard but is often used by web servers, web applications, and caching systems to pass information between the server/application and the browser.

Examples: X-Powered-By, X-Frame-Options, X-Content-Type-Options, X-Cache, X-Request-Id

{
  "headers": {
    "Content-Type": "text/html; charset=UTF-8",
    "Server": "nginx/1.18.0",
    "Cache-Control": "max-age=3600",
    ...
  },
  "security": [
    true,  // Strict-Transport-Security
    false, // Content-Security-Policy
    true,  // X-Frame-Options
    true,  // X-Content-Type-Options
    false, // Referrer-Policy
    false  // Permissions-Policy
  ]
}

fetch('https://operatetools.com/http-headers-checker/check?url=https://example.com')
  .then(response => response.json())
  .then(data => {
    console.log('Headers:', data.headers);
    console.log('Security Analysis:', data.security);
  })
  .catch(error => console.error('Error:', error));

curl "https://operatetools.com/http-headers-checker/check?url=https://example.com"

import requests

url = "https://operatetools.com/http-headers-checker/check"
params = {"url": "https://example.com"}

response = requests.get(url, params=params)
data = response.json()

print("Headers:", data["headers"])
print("Security Analysis:", data["security"])

{
  "error": "Unable to retrieve headers."
}