📖 What is this tool?
HTTP Response Inspector fetches and displays all HTTP response headers from any public URL. Quickly check status codes, content types, CORS policies, caching headers, security headers and server information.
💡 Example
Input
https://api.github.com
Output
Status: 200 OK
content-type: application/json
x-ratelimit-limit: 60
cache-control: public, max-age=60
🛠️ Common Use Cases
- Debug CORS issues in web applications
- Check if security headers are properly set
- Verify caching headers (Cache-Control, ETag)
- Inspect redirect chains
- Check content-type for API responses
❓ Frequently Asked Questions
Why does some URL inspection fail? ▾
Some servers block cross-origin requests (CORS policy). If a URL doesn't allow browser requests from other domains, inspection will fail. Try public APIs like api.github.com.
What is a CORS header? ▾
Access-Control-Allow-Origin is a CORS header that tells browsers which domains are allowed to make requests. Missing or misconfigured CORS headers are a common cause of API failures in web apps.
What are important security headers to check? ▾
Look for: Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy and X-XSS-Protection. Missing these headers are security vulnerabilities.
🔒
Your data stays private. All processing happens entirely in your browser. Nothing is ever sent to our servers. You can use this tool offline after the page loads.