Question 1

Why can't the checker always fetch directly?

Accepted Answer

Browsers enforce same-origin policy. A fetch to `https://api.example.com` from this site only succeeds if `api.example.com` sends `Access-Control-Allow-Origin` allowing this site. Most servers don't, so the fetch fails or returns an opaque response with no readable headers. Workaround: paste headers manually from `curl -I` or your browser DevTools' Network tab.

Question 2

How do I get headers from curl?

Accepted Answer

`curl -I ` does a HEAD request and prints just the headers. `curl -i ` does a GET and prints headers + body. For HTTPS with verbose info: `curl -v `. To follow redirects: add `-L`. To save just headers: `curl -D headers.txt `. Paste the output here for clean rendering and highlighting of security-relevant headers.

Question 3

What security headers should I look for?

Accepted Answer

`Strict-Transport-Security` (HSTS), `Content-Security-Policy`, `X-Content-Type-Options: nosniff`, `X-Frame-Options` or `frame-ancestors` in CSP, `Referrer-Policy`, `Permissions-Policy`. Missing or weak versions are common findings in security scans. Tools like securityheaders.com grade sites on these; the checker shows them so you can audit your own.

Question 4

How do I tell if a response is cached?

Accepted Answer

Look for: `Cache-Control` (the directive), `Age` (seconds in cache), `X-Cache: HIT` / `MISS` (CloudFront, Fastly), `CF-Cache-Status: HIT` / `MISS` (Cloudflare), `X-Vercel-Cache: HIT` / `MISS` (Vercel). `Age: 0` means just-fetched from origin; `Age: 3600` means an hour-old cache entry. `Etag` and `Last-Modified` show what the client can use for conditional requests.

Question 5

What's the difference between Server: nginx and Server: cloudflare?

Accepted Answer

`Server` identifies the software handling the request. Direct origin: nginx, apache, Express, Caddy. Behind a CDN: cloudflare, AmazonS3, CloudFront, Fastly. Knowing the stack helps when debugging, Cloudflare's `cf-ray` header lets you correlate with their logs; Fastly has `x-fastly-trace-id`. Hosts sometimes hide `Server` for security-through-obscurity; mostly useless against modern recon.

Question 6

Why does HEAD return different headers than GET?

Accepted Answer

Per spec they should return identical headers; the body differs (HEAD has none). In practice: some servers compute Content-Length only when generating the body, so HEAD may omit it. Some caches treat HEAD and GET as separate keys. Some CDNs route them differently. If two diverge, the GET response is usually what clients actually see; HEAD is a probe.

Question 7

What's a 304 Not Modified response?

Accepted Answer

Server's reply to a conditional request: "your cache copy is still good, don't re-download." Triggered by client sending `If-None-Match: ` or `If-Modified-Since: ` and the server matching. The response has headers but no body. Browser uses its cached body. Saves bandwidth for unchanged resources without losing the freshness check.

Question 8

Is the URL I check sent anywhere?

Accepted Answer

The browser makes the fetch directly from your tab to the URL you entered. There's no proxy through us. The URL and the headers stay between your browser and that server. For URLs that require authentication, the request goes through the browser's normal cookie/auth context, if you're logged into the target, the request will be authenticated.

Question 9

What standards does HTTP Header Checker validate against?

Accepted Answer

HTTP Header Checker checks compliance with Relevant specification.

Question 10

What are the limitations of HTTP Header Checker?

Accepted Answer

Checks are heuristic, may not catch all issues Does not replace comprehensive testing

Range	Classification	Semantic Context
2xx	Success	The request was successfully received and accepted.
3xx	Redirection	Further action needed to complete the request.
4xx	Client Error	The request contains bad syntax or cannot be fulfilled.
5xx	Server Error	The server failed to fulfill an apparently valid request.

HTTP Header Checker

Learn More

HTTP Security Headers: The 2026 Complete Checklist

The Complete HTTP Status Code Cheatsheet (2026)

What is HTTP Header Checker?

Frequently Asked Questions

Technical Deep Dive

HTTP Header Checker

Fetch or paste

Plain-English notes

Direct request

01 Response Status Matrix

02 Header Analysis Pipeline

Runs 100% in your browser

You Might Also Need

Git Commit Message Generator

Regex Explainer

AI Code Review Assistant

API Client Code Generator