Understanding HTTP Headers
WAF Bypass & Spoofing
Modern sites use Web Application Firewalls (like Cloudflare or Akamai) that block automated bots. Our tool allows you to inject advanced Sec-Fetch headers to mimic a standard browser, bypassing protections to inspect real headers.
CORS & Redirects
Follow the full path of redirects (301, 302, 307) to identify infinite loops, or toggle the CORS Preflight simulator to dispatch an OPTIONS request to debug cross-origin API rejections.
Frequently Asked Questions
Why is a WAF or server blocking my HTTP header request?
Many Web Application Firewalls (like Cloudflare or Akamai) block automated requests. Use the Identity dropdown to select Standard Browser — this sends realistic Sec-Fetch headers that allow the tool to fetch the real HTTP response headers past the firewall.
How do I test CORS preflight requests (OPTIONS)?
Check the "Simulate CORS Preflight" box before fetching. This tells our tool to dispatch an HTTP OPTIONS request instead of a standard GET request, allowing you to debug cross-origin API rejections and view Access-Control-Allow headers.
What are HTTP security headers and why do they matter?
Security headers such as Content-Security-Policy and X-Frame-Options are server instructions that tell the browser how to handle the page's security. They protect against vulnerabilities like cross-site scripting (XSS), clickjacking, and code injection.
How do I check if my website has HSTS enabled?
Enter your website URL and click Fetch. Look for the Strict-Transport-Security header in the results. If it is present, HSTS is enabled. Our tool will automatically attach a green "Secure" badge to valid security headers.
How do I export my HTTP headers for bug reports?
After fetching the headers, click the Download JSON button in the results toolbar. This exports the full multi-hop redirect chain and header list into a clean JSON file suitable for attaching to engineering tickets.