HTTP Headers Analyzer

What the Analyzer Does

HTTP response headers are the lines a server sends before a page's content. They tell the browser how to cache the response, which security rules to apply, what type of content it is and much more. They're invisible on the page itself, so a tool like this is the quickest way to check them.

1. Enter a page URL. If you leave out the scheme, https:// is added.
2. Orbit2x's server sends one GET request and follows up to 10 redirects, recording each one. The page body isn't downloaded.
3. You get the final status, protocol and time until the headers arrived, a review of the security-related headers, every header grouped by purpose, and the raw headers to copy.

To check just a status code or a redirect chain, the HTTP status checker and redirect checker are more focused.

Security Headers Explained

These are the headers the review checks, with a common starting value. Test changes on a staging site first: a strict Content-Security-Policy in particular can break scripts, so many sites begin with Content-Security-Policy-Report-Only.

The review also flags cookies without Secure, HttpOnly or SameSite; Server and X-Powered-By headers that reveal software versions; the deprecated X-XSS-Protection header; and Access-Control-Allow-Origin set to * (combined with Allow-Credentials: true, browsers reject it). The OWASP Secure Headers Project and MDN's header reference go into more detail.

Adding Security Headers

Most sites set these headers in the web server or CDN configuration. For example:

nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "SAMEORIGIN" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache (mod_headers)

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" Header always set X-Content-Type-Options "nosniff" Header always set X-Frame-Options "SAMEORIGIN" Header always set Referrer-Policy "strict-origin-when-cross-origin"

In nginx, an add_header inside a location block replaces all add_header lines inherited from the server block, so repeat them there or set them in one place. Only add includeSubDomains to HSTS once every subdomain works over HTTPS. The nginx config generator can produce a starting configuration.

Caching and Server Headers

• Cache-Control sets how long a response may be reused (max-age), whether shared caches may store it (public or private), or that it must be revalidated (no-cache) or never stored (no-store).
• ETag and Last-Modified let a browser ask "has this changed?" and get a short 304 Not Modified reply instead of the whole file.
• Vary lists request headers that change the response, such as Accept-Encoding, so caches keep separate copies.
• Age is how many seconds a cache has held the response; it usually means a CDN served it.
• Server, Via, CF-Ray, X-Cache and similar headers identify the server software, proxies and CDN. CF-Ray, for example, is a Cloudflare request ID ending in the data centre code.

Checking Headers Yourself

In a browser, open the developer tools, go to the Network tab, reload, and select the first request to see its response headers, as your browser received them. From a terminal:

curl -sS -D - -o /dev/null https://example.com

That makes a GET request and prints only the headers. curl -I is shorter but sends a HEAD request, and some servers answer HEAD differently.

How Requests Are Made

The URL you enter is sent to Orbit2x's server, which requests it and returns the headers. Nothing is stored. The website you analyze sees a request from Orbit2x's server, not from you, with the user agent Orbit2xHeadersAnalyzer/1.0. Connections are made over TLS 1.2 or newer, and sites with invalid certificates are reported as errors rather than fetched insecurely. See the privacy policy for general data practices.

Frequently Asked Questions