HTTP Header Inspector at a glance
- What it does
- Inspect the HTTP headers your browser sends with every request, and learn what each one does - from Accept-Language to the security headers that matter.
- Where it runs
- In your browser, plus one request to a request-echo endpoint
- Works offline
- No — it needs a live service to answer
- Cost
- Free, with no account and no usage limit
- Category
- Browser & Network
How to use the header inspector
- Load the page - the request headers your browser sent are fetched and listed.
- Look for the header you are debugging, most often
User-Agent,Accept-LanguageorReferer. - Compare across browsers if you are chasing a bug that only reproduces in one of them.
Request headers worth knowing
| Header | Purpose |
|---|---|
Host | Which domain the request is for. Required, and how one server hosts many sites on one IP. |
User-Agent | Browser and platform identification. Historically abused for content switching; feature detection is the modern answer. |
Accept | Which content types the client can handle, with preference weights. |
Accept-Language | Preferred languages. The correct signal for localisation - far better than guessing from an IP address. |
Accept-Encoding | Which compression the client supports, typically gzip, br. Brotli usually beats gzip by 15-20% on text. |
Referer | The page that linked here. Misspelled in the original specification and never corrected. Controlled by Referrer-Policy. |
Cookie | Cookies previously set by this origin, sent on every matching request. |
Authorization | Credentials - a Base64 Basic pair or a bearer token. Inspect tokens with the JWT decoder. |
If-None-Match | An ETag the client already holds. Lets the server reply 304 Not Modified and send nothing. |
Response headers that harden a site
These are set by the server rather than the browser, and getting them right prevents entire classes of attack.
| Header | What it prevents |
|---|---|
Content-Security-Policy | Restricts which scripts, styles and frames may load. The single most effective defence against cross-site scripting, and the fiddliest to deploy. |
Strict-Transport-Security | Forces HTTPS for a set period, closing the window where a first plain-HTTP request could be intercepted. |
X-Content-Type-Options: nosniff | Stops the browser guessing a content type, which could turn an uploaded file into executable script. |
X-Frame-Options / frame-ancestors | Clickjacking - your page being framed invisibly over someone else's buttons. |
Referrer-Policy | Leaking full URLs, including query parameters, to third parties. |
Permissions-Policy | Silently grants or denies camera, microphone and geolocation to embedded frames. |
Caching headers, briefly
Most perceived slowness on repeat visits is a caching configuration problem rather than a server one.
Cache-Control is the header that matters. max-age=31536000, immutable is right for a file whose name contains a content hash, because that URL can never change. no-cache means the client may keep a copy but must revalidate before using it - which is not the same as no-store, meaning do not keep a copy at all.
ETag and Last-Modified support revalidation: the client asks "still the same?" and a 304 response with no body confirms it. Getting this right turns a full download into a few hundred bytes.
CORS, and why fetch fails in the console
Browsers block a page on one origin from reading a response from another unless that other server opts in with Access-Control-Allow-Origin. This is not a bug and cannot be disabled from the requesting side - the restriction protects users from a malicious page reading their authenticated data on other sites.
For anything other than a simple GET, the browser first sends an OPTIONS preflight asking which methods and headers are permitted. A request that fails before your handler runs, with nothing in the server log, is nearly always a preflight the server did not answer correctly.
Frequently asked questions
A typo in the original 1996 specification. By the time anyone noticed, too much software depended on it to change. The correctly spelled Referrer-Policy header, added much later, controls its behaviour.
Only in limited ways. Extensions can strip or rewrite some, and Referrer-Policy controls referrer detail. Core headers such as Host are required for the request to work at all.
Strict-Transport-Security and X-Content-Type-Options: nosniff take a minute and rarely break anything. Content-Security-Policy delivers the most protection but needs care - deploy it in report-only mode first and watch what it would have blocked.
On the server that owns the resource, by returning the appropriate Access-Control-Allow-Origin header and answering preflight OPTIONS requests. If you do not control that server, proxy the request through your own backend.
What this tool sends, and what it does not
Most OmniTool utilities make no network request at all. This one is an exception, and it is worth being precise about it: to do its job, this tool contacts a request-echo endpoint, so it can show you what your browser sent. That request goes directly from your browser to that service — we do not proxy it, and we never receive a copy of it or of the response.
Nothing else on this page is transmitted, and we keep no record of what you looked up. The privacy policy lists every tool on the site that makes an outside request, along with what our advertising partner collects.