API Header Viewer
Web & SEOFetch and display all HTTP response headers from any URL. Instantly inspect CORS, cache-control, security headers, cookies, and more.
Raw Headers
Filter
Parsed Headers12
Content-TypeContent
application/json; charset=utf-8
AuthorizationAuth
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
Cache-ControlCache
no-cache, no-store, must-revalidate
X-Request-IdOther
a1b2c3d4-e5f6-7890-abcd-ef1234567890
Strict-Transport-SecuritySecurity
max-age=31536000; includeSubDomains
X-Content-Type-OptionsSecurity
nosniff
X-Frame-OptionsSecurity
DENY
Set-CookieCookie
session=abc123; Path=/; HttpOnly; Secure; SameSite=Strict
AgeCache
24
VaryCache
Accept-Encoding, Accept-Language
Access-Control-Allow-OriginCORS
https://example.com
Content-EncodingContent
gzip
About API Header Viewer
The API Header Viewer fetches the HTTP response headers returned by any public URL and displays them in a clean, readable format. Instantly see CORS policy headers, cache-control directives, content-type, server information, security headers like Strict-Transport-Security and X-Frame-Options, and any custom headers your server sends. No browser extension or command-line tool required — just paste a URL and inspect.
Features
- ✓Fetches response headers from any publicly accessible URL
- ✓Groups headers by category: CORS, caching, security, and general
- ✓Highlights missing or misconfigured security headers
- ✓Displays raw header name-value pairs for copy-paste use
- ✓Shows HTTP status code and redirect chain when applicable
- ✓Works with both HTTP and HTTPS endpoints
- ✓No installation or authentication required
Common Use Cases
- Verifying CORS headers are correctly set for cross-origin API calls
- Checking whether a CDN is serving stale or correctly cached content
- Auditing security headers before a production deployment
- Confirming Content-Security-Policy is applied as expected
- Debugging missing or incorrect cache-control directives
- Validating cookie attributes such as Secure and HttpOnly flags
Frequently Asked Questions
QWhy can't I see headers for a private or internal URL?
The tool fetches headers via your browser. A URL that is not publicly accessible — behind a VPN or firewall — will not be reachable from your browser and will result in a network error.
QDoes this tool follow redirects?
Yes. The tool follows redirects and shows the final response headers. A redirect chain summary is displayed when one or more 3xx responses are encountered.
QCan I use this to check CORS headers before deploying?
Absolutely. Paste your API endpoint URL, and the tool will display the Access-Control-Allow-Origin, Access-Control-Allow-Methods, and related CORS headers so you can verify them quickly.
QAre the requests made from my browser or a proxy server?
Requests are made from your browser. This means results reflect exactly what a browser client would receive, including any CORS restrictions.