TextTool.in

HTTP Header Viewer

Inspect HTTP response headers, analyze security settings, and understand how your server configures caching, content types, and browser protections.

Enter a URL to retrieve the available HTTP response-header information for the requested resource, or switch to Raw Header Paste mode when inspecting local or offline captures.

Provider: HackerTarget HTTP Headers API (GET)
Supports HTTP/HTTPS URLs (defaults to https:// when scheme is omitted)
Ready to inspect Enter an HTTP or HTTPS URL above and click Check Headers to fetch real response headers.

Automated Verification Suite Results

No response inspected yet. Enter a URL above and click Check Headers to inspect target status, response headers, caching rules, server metadata, and security policies.
No observed HTTP response headers to display yet. Run a URL check or analyze pasted headers to populate this table.
Security header evaluation runs only on real observed response data. Inspect a URL first to view evidence-based security findings.
Inspect a URL to check for HTTP Link response headers and resource hints (preload, prefetch, preconnect, dns-prefetch, modulepreload, prerender).
No raw header data available yet. Inspect a URL or paste raw headers to view the textual representation.

About This HTTP Header Viewer

HTTP response headers provide metadata about a web server's response. They can describe content types, caching behavior, redirects, browser security policies, and infrastructure-related information. TextTool.in's HTTP Header Viewer retrieves available response-header information through its configured inspection provider (api.hackertarget.com/httpheaders/) or analyzes user-pasted raw response transcripts directly in your browser, presenting observed fields in a structured, readable format.

How to Use the Tool

  1. Enter a valid HTTP or HTTPS URL in the input field (or switch to Analyze Pasted Raw Headers for local captures).
  2. Click Check Headers (or press Enter) to request the target URL's response headers.
  3. Review the returned target HTTP status code, redirect chain (when observed), and available response headers.
  4. Search by header name, value, or category, and sort headers in the Headers tab.
  5. Click or focus any header's Info button to understand what that field controls and why it matters.
  6. Review evidence-based Security and Caching observations based strictly on the returned headers.
  7. Inspect parsed Link Resource Hints such as preload, preconnect, and dns-prefetch.
  8. Copy individual headers, copy the security report, or export the actual results as TXT, JSON, or CSV.

Understanding Key HTTP Response Headers

HTTP Status & Response Metadata
The HTTP status line (such as 200 OK or 301 Moved Permanently) describes the outcome of the HTTP request, while response headers carry key-value metadata describing the representation and server instructions.
Content-Type & Encoding
Content-Type declares the media type and character encoding (e.g., text/html; charset=utf-8), while Content-Encoding specifies transfer compression such as br, gzip, or zstd.
Cache-Control & Validators
Cache-Control governs how browsers and shared CDN caches store and reuse responses (e.g., no-store, no-cache, max-age), paired with validators like ETag and Last-Modified.
Content-Security-Policy & HSTS
Content-Security-Policy restricts permitted resource origins and script execution to reduce XSS risk, while Strict-Transport-Security (HSTS) instructs browsers to connect only over HTTPS for future requests.
Link & Resource Hints
The Link header can convey early resource hints (rel=preload, rel=preconnect, rel=dns-prefetch, rel=prefetch, rel=modulepreload) as well as canonical or pagination links.
Custom & Vendor Headers
Headers prefixed with CF-, X-Amz-, X-Cache, or X-Served-By vary by CDN, reverse proxy, cloud provider, or application framework and remain preserved in the full table and raw view.

Transparency, CORS Architecture & Privacy Notice

Modern browsers enforce Cross-Origin Resource Sharing (CORS) policies that prevent client-side JavaScript on a standalone webpage from directly reading arbitrary cross-origin HTTP response headers. To retrieve real headers without requiring you to deploy a custom backend, Live URL Inspection sends the target URL to the public HackerTarget HTTP Header Check endpoint (https://api.hackertarget.com/httpheaders/?q=...). Because the external inspection service receives the target URL and performs the remote HTTP GET request from its public scanner, private LAN addresses (such as localhost or 192.168.x.x) cannot be reached remotely—use Analyze Pasted Raw Headers to inspect private or internal endpoints locally in your browser.