Header Inspector
Inspect HTTP response headers with security grading, caching analysis, and TLS details.
What is a Header Inspector?
An HTTP header inspector analyzes the response headers returned by a web server when you request a URL. Headers carry critical metadata — security policies, caching directives, content types, CORS rules, and server identity — that affect how browsers render pages, how intermediaries cache content, and how secure the connection is.
HTTPSense's Header Inspector goes beyond listing headers. It evaluates security headers against best practices, assigns a letter grade (A+ to F) based on value analysis rather than mere presence, measures response timing, and categorises every header for quick navigation. Whether you are hardening a production site or debugging a CORS issue, the Header Inspector gives you the complete picture.
How to Use the Header Inspector
- Enter a URL in the search bar and click Inspect Headers.
- Review the Overview tab for connection details, server identity, TLS info, and the full response/request headers (toggle between By Category and All Headers).
- Switch to the Security tab to see individual security headers scored with detailed explanations.
- Check the Timing tab for a waterfall breakdown of DNS, TCP, TLS, and time-to-first-byte.
- Use the Raw tab to copy or download the full JSON response.
How the Header Inspector Works
We issue a single HTTP GET to the target URL and follow redirects up to a small cap so the headers we evaluate belong to the final response — the same response a browser would render. We capture every response header, the negotiated TLS version (for HTTPS), the resolved IP, and per-stage timing (DNS, connect, TLS, TTFB, transfer).
Each security-relevant header (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP, Set-Cookie attributes) is scored against a built-in ruleset that looks at the configured value, not just presence. Points are summed into a weighted score that maps to a letter grade. Caching, CORS, server-fingerprint, and content headers are surfaced separately, grouped by category.
Header Inspector is a URL-level tool — grades belong to the exact path you submitted. We do not parse or execute the response body, so SPA-injected behaviour is not analysed here.
Key Features
- Value-based security grading — Scores headers like CSP, HSTS, and X-Frame-Options by analysing their configured values, not just their presence.
- Response timing waterfall — Visualises DNS lookup, TCP connect, TLS handshake, and time-to-first-byte in an easy-to-read chart.
- Categorised header view — Groups headers into Security, Caching, CORS, Content, Server, and Custom categories.
- CORS debugging — Highlights Access-Control headers so you can quickly diagnose cross-origin issues.
- SSRF protection — Blocks requests to private IP ranges and internal networks for safe server-side inspection.
Common Use Cases
- Security engineers — Verify that Content-Security-Policy, Strict-Transport-Security, and other security headers are correctly configured.
- DevOps teams — Debug caching behaviour by inspecting Cache-Control, ETag, and Vary headers across environments.
- Frontend developers — Troubleshoot CORS errors by examining Access-Control-Allow-Origin and related headers.
- Compliance auditors — Confirm security header presence and strength to meet PCI-DSS, SOC 2, or internal policy requirements.
Frequently Asked Questions
Does the Header Inspector grade my whole site or just one URL?
Just the URL you submit. Headers — especially CSP, caching directives, and Set-Cookie attributes — commonly differ by path, so the grade is URL-specific.
Why is my Content-Security-Policy marked as weak?
We flag overly permissive directives such as unsafe-inline, unsafe-eval, wildcard sources, and missing nonces or hashes. The Security tab explains each finding.
Will it follow redirects?
Yes, up to a small redirect cap. The headers analysed are those of the final, non-3xx response so the grade reflects what a browser actually evaluates.
Is it free? Do I need to sign up?
Yes, the Header Inspector is free with no signup or API key required.
How does the security score map to a letter grade?
The score is computed by weighting individual security checks — HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP, and Set-Cookie attributes — against their configured values, not just whether the header is present. Scores map to grades as: 95+ → A+, 85–94 → A, 70–84 → B, 55–69 → C, 40–54 → D, below 40 → F. Each finding in the Security tab shows what was checked and why it scored as it did, so you can see exactly which directives drove the grade.