HTTP Headers Inspector

One input per line. Output is numbered to match the input order.
Pinned tools are listed in your favourites on the home page.Copies a link to this tool that carries your current input, so it opens ready to run.Gives you an iframe snippet for putting this tool on your own site.
Acceptrequest

Media types the client can handle (e.g., text/html, application/json).

Access-Control-Allow-Credentialsresponse

Set to "true" to let the browser expose a cross-origin response to JavaScript when the request carried cookies or HTTP auth.

Access-Control-Allow-Headersresponse

Request headers the server permits on the real cross-origin request; answers a preflight OPTIONS.

Access-Control-Allow-Methodsresponse

HTTP methods the server permits cross-origin (e.g., GET, POST, PUT); answers a preflight OPTIONS.

Access-Control-Allow-Originresponse

Origin allowed to read the response: a specific origin or *. Cannot be * when credentials are included.

Access-Control-Max-Ageresponse

How many seconds the browser may cache a CORS preflight result before asking again.

Accept-Encodingrequest

Compression algorithms the client accepts (gzip, deflate, br).

Accept-Languagerequest

Preferred languages for the response (e.g., en-US,en;q=0.9).

Authorizationrequest

Credentials for authenticating the client (Bearer token, Basic auth, etc.).

Cache-Controlboth

Caching directives (e.g., no-cache, max-age=3600, public, private).

Connectionboth

Controls whether the network connection stays open (keep-alive or close).

Content-Encodingboth

Encoding applied to the body (gzip, deflate, identity).

Content-Lengthboth

Size of the request or response body in bytes.

Content-Security-Policyresponse

Restricts where scripts, styles, images, and frames may load from — the primary defence against XSS (e.g., default-src 'self').

Content-Typeboth

Media type and encoding of the request/response body (e.g., application/json; charset=utf-8).

Cookierequest

HTTP cookies previously set by the server, sent back with requests.

ETagresponse

Unique identifier for a version of a resource, used for caching.

Hostrequest

Domain name and port of the server being requested. Required in HTTP/1.1.

If-Modified-Sincerequest

Returns the resource only if modified after the given date (conditional GET).

If-None-Matchrequest

Returns the resource only if the ETag does not match (conditional GET).

Last-Modifiedresponse

Date and time the resource was last changed.

Locationresponse

URL to redirect the client to (used with 3xx responses).

Originrequest

Origin of the cross-site request, used in CORS preflight requests.

Refererrequest

URL of the page making the request (note: misspelling is intentional in the HTTP spec).

Retry-Afterresponse

How long to wait before making another request (used with 429 or 503).

Serverresponse

Information about the server software handling the request.

Set-Cookieresponse

Sets a cookie in the client; may include attributes like HttpOnly, Secure, SameSite.

Strict-Transport-Securityresponse

Forces HTTPS by telling browsers not to use HTTP for a given duration (HSTS).

Transfer-Encodingboth

Encoding for the message body (chunked, compress, deflate, gzip, identity).

User-Agentrequest

String identifying the client browser, OS, and version.

Varyresponse

Tells caches which request headers affect the response (e.g., Vary: Accept-Encoding).

WWW-Authenticateresponse

Authentication method the server requires (used with 401 responses).

X-Content-Type-Optionsresponse

Prevents MIME-type sniffing; value "nosniff" instructs browser to use declared content type.

X-Frame-Optionsresponse

Controls embedding in iframes: DENY, SAMEORIGIN, or ALLOW-FROM uri.

X-Forwarded-Forrequest

Original IP address of the client when passing through proxies or load balancers.

X-Requested-Withrequest

Indicates an AJAX request; typically set to "XMLHttpRequest" by JS libraries.

X-XSS-Protectionresponse

Legacy XSS filter directive (deprecated in modern browsers, but still sent for legacy support).

Ctrl+Enter Run  · Ctrl+Shift+C Copy  · Esc Clear

Understand HTTP Headers Inspector

一份常见 HTTP 请求头与响应头的参考，外加一个把粘贴进来的原始头部块转成结构化键值对的解析器。

How it works

HTTP 头是面向行的：一个名称、一个冒号、一个值，以 CRLF 结束，空行标志整个头部块结束。名称不区分大小写，这也是 HTTP/2 和 HTTP/3 在链路上把它们全部小写化的原因。这里的解析器在每行的第一个冒号处切分，好让含冒号的值（Location 中的 URL、Retry-After 中的时间）保持完整；旁边的参考则标注每个头属于请求侧、响应侧还是两者皆可。一切都在本地运行——本工具读取你粘贴的头，不会从某个 URL 去抓取它们。

When to use it

  • 粘贴从 DevTools 网络面板或 `curl -i` 输出中复制的头部块，把它当作结构化列表来阅读
  • 在把陈旧响应归咎于 CDN 之前，先检查实际发送的是哪些 Cache-Control 指令
  • 查阅一个响应应当携带哪些安全头（Strict-Transport-Security、X-Content-Type-Options、X-Frame-Options），以及每个取值的作用
  • 确认你预期的某个头——Vary、ETag、Access-Control-Allow-Origin——是否真的存在

Watch out for

  • 本工具不会去抓取 URL。它解释并解析你提供的头；要捕获真实的头，请使用 `curl -I`、DevTools 网络面板或 REST 客户端。
  • 重复的头名称是合法且有意义的。一个响应可以携带多行 Set-Cookie；扁平的键值视图只会保留重名者中的最后一个，因此当 cookie 莫名消失时，请查看原始头部块。
  • "Referer" 的拼写错误出自原始规范，且已成定局。晚得多才加入的 Referrer-Policy 拼写是正确的——把其中任何一个拼错，都会悄无声息地什么也不做。
  • X-XSS-Protection 已经作废。现代浏览器要么忽略它，要么已经移除它，而非零取值本身还可被利用；取代它的是 Content-Security-Policy。

Frequently Asked Questions

Cache-Control 头是做什么的？

Cache-Control 指示浏览器和 CDN 的缓存行为。关键取值：no-cache（使用缓存前先重新验证）、no-store（永不缓存）、max-age=3600（缓存 1 小时）、public（可被 CDN 缓存）、private（仅浏览器缓存）、immutable（永不重新验证，用于带版本号的静态资源）。

CORS 需要哪些头？

简单请求：Access-Control-Allow-Origin: *（或指定来源）。需要预检的请求（POST/PUT/自定义头）：还需要 Access-Control-Allow-Methods、Access-Control-Allow-Headers，以及可选的 Access-Control-Max-Age。带凭据的请求需要 Access-Control-Allow-Credentials: true。

Strict-Transport-Security 头是什么？

HSTS（HTTP 严格传输安全）告诉浏览器在设定的时长内只通过 HTTPS 连接：Strict-Transport-Security: max-age=31536000; includeSubDomains。一次 HTTPS 访问之后，浏览器会在一年内拒绝明文 HTTP。请谨慎使用——启用之前 HTTPS 必须已经正常工作。

How to Use HTTP Headers Inspector

  1. Paste or type your input in the input area above.
  2. The tool processes your input automatically or click Run.
  3. Copy or download the result using the action buttons.
  4. Use Ctrl+Enter to run quickly from the keyboard.