Why Inspect HTTP Headers?

HTTP headers carry control information such as content type, caching policies, encoding, authentication details, and security directives. A headers lookup helps developers and site owners:

• Diagnose content issues (wrong Content-Type or encoding).
• Confirm caching and CDN behavior (Cache-Control, Vary).
• Verify security headers (Content-Security-Policy, Strict-Transport-Security).
• Trace redirects (Location) and authentication flows (WWW-Authenticate).

Common Headers to Check

Response headers

Key response headers to review include:

• Content-Type — media type of the response body.
• Content-Encoding — compression method (gzip, br).
• Cache-Control, Expires, Vary — caching behavior.
• Set-Cookie — cookies and their security flags (HttpOnly, Secure, SameSite).
• Server — server software and often version info.
• Strict-Transport-Security — HSTS policy for HTTPS enforcement.
• Content-Security-Policy — XSS and resource-loading restrictions.

Request headers

Useful request headers include User-Agent, Accept, Accept-Encoding, and Authorization. Modifying these can change server responses for testing.

How to Perform an HTTP Headers Lookup

Choose a tool based on your needs:

• Browser DevTools (Network tab) — Inspect headers for any resource loaded by the page.
• curl (command line) — Quick, scriptable lookups from any environment.
• Online header checkers / proxy tools — Useful to see how an external client or geographic location is handled.
• HTTP libraries — Use Python requests, Node fetch, etc., to automate checks.

Practical curl examples

curl -I https://example.com
# shows only response headers

curl -v https://example.com
# verbose: shows request and response headers and TLS info

curl -I -L https://example.com
# follow redirects (-L) and show final response headers

curl -H "User-Agent: MyBot/1.0" -I https://example.com
# send custom request header

Interpreting Results

When reading headers, focus on three goals:

1. Correctness: Ensure Content-Type and encoding match the body.
2. Security: Confirm presence and proper configuration of security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy).
3. Performance: Validate caching headers (long-lived static assets use aggressive caching + cache-busting; dynamic responses avoid over-caching).

Look for warning signs such as missing HSTS on HTTPS sites, incorrect SameSite or HttpOnly cookie flags, or overly permissive CSP policies.