Website Tools

HTTP Headers Checker

See every HTTP response header a website sends back to browsers.

Not sure what to enter? Try an example: github.com

Free & instant No signup How to use FAQ

Retrieved

github.com

Important Response Headers

Server

github.com

Content-Type

text/html; charset=utf-8

Content-Length

—

Cache-Control

max-age=0, private, must-revalidate

Expires

—

ETag

W/"6c4acfed3f0f773e665e32fb519fac07"

Last-Modified

—

Strict-Transport-Security

max-age=31536000; includeSubdomains; preload

Content-Encoding

—

X-Powered-By

—

All Response Headers

Date	Sat, 17 Oct 2026 23:31:26 GMT
Content-Type	text/html; charset=utf-8
content-language	en-US
Vary	X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, X-GitHub-Client-Version, Accept-Language, Sec-Fetch-Site,Accept-Encoding, Accept, X-Requested-With
ETag	W/"6c4acfed3f0f773e665e32fb519fac07"
Cache-Control	max-age=0, private, must-revalidate
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Frame-Options	deny
X-Content-Type-Options	nosniff
X-XSS-Protection	0
Referrer-Policy	origin-when-cross-origin, strict-origin-when-cross-origin
Content-Security-Policy	default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com .rel.tunnels.api.visualstudio.com wss://.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com .actions.githubusercontent.com wss://.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com api.github.com/cmc_internal/api/ edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com .googleusercontent.com objects-origin.githubusercontent.com .githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com 'sha256-tSjmyPUky1KbRZ0fw9VUil3wFEbeM82rtbJDygGJAXw='; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
Server	github.com
Accept-Ranges	bytes
Set-Cookie	_gh_sess=lmsjrj%2FNYEdQZtbwee%2BF4jT3amwbwHIFznTlLylcK9XJi%2By7lCTpRey29R8P7tJZnZ%2FArdF0dcyCgLGDTGM1%2BoFZhRYjFjdVcig14zAmUQ3KDCYfcikqhGBp%2Bt%2FVoAPZCz8FpgoY9WiEcXlogjep0L%2BHDLRqb%2B6vDKSsi7%2BC3E5BiHZ9qEb45HPuxPGWhOwjEllVTA44Gpyt1UKfRNTusuNIRMm6sr4PsrDqYviiM76oeJDgNcR9rjReZlimgobaHCv3bDrEKXXLUBIqmPyhSg%3D%3D--JlXyXkTBmbHIWq%2B6--ENm%2FGeQ8JeUXpqbwmNNRNg%3D%3D; path=/; HttpOnly; secure; SameSite=Lax, _octo=GH1.1.1421230687.1792279892; expires=Sun, 17 Oct 2027 23:31:32 GMT; domain=.github.com; path=/; secure; SameSite=Lax, logged_in=no; expires=Sun, 17 Oct 2027 23:31:32 GMT; domain=.github.com; path=/; HttpOnly; secure; SameSite=Lax
X-GitHub-Request-Id	C5E4:105807:2BC49CE:3E1BDD3:6AD40554
x-github-edge-region	centralindia
Transfer-Encoding	chunked

Last checked: 19 seconds ago Cached

Download JSON Download PDF

100/100

Result Summary

Passed

Responded with status 200

Enter a URL to see the full list of response headers - server software, caching rules, security headers, cookies and more.

What are HTTP response headers?

HTTP response headers are the name-value lines a server sends before the page content. They describe the response (Content-Type, Content-Length), control caching (Cache-Control, ETag), identify the server and set security policies (Strict-Transport-Security, Content-Security-Policy). This tool lists every header a URL returns.

How to view a website's HTTP headers

Enter the domain or URL in the box above.
Click Check Headers.
Review caching headers (Cache-Control, Expires) and security headers (HSTS, CSP, X-Frame-Options).
Remove headers that reveal unnecessary detail, such as exact server or framework versions.

Related checks

For a scored review of security headers, use the Security Headers Checker.
To focus on caching, use the Cache Headers Checker.

JustChecker monitors your websites around the clock and alerts you the instant something changes.

Frequently Asked Questions

A CDN or cache may still be serving an older response, the rule may apply only to some file types, or another layer may strip it. Purge the cache and check that the rule matches the page you tested.

Hiding the exact version (for example nginx/1.18.0) is a sensible precaution, because it tells attackers which known bugs to try. Use server_tokens off in Nginx or ServerTokens Prod in Apache.

Cache-Control, ETag or Last-Modified, and Content-Encoding. The Cache Headers Checker and GZIP Compression Checker look at those in more detail.

Share this tool:

Need a website for your business? Only $599