Request Header Inspector
API & BackendParse raw HTTP headers and see what each one actually does.
Runs entirely in your browser — nothing is uploaded
Features
- Paste raw headers and get a parsed, explained table.
- Reference notes for every standard header.
- Decodes User-Agent, Accept and Cache-Control into readable parts.
- Flags missing security headers on responses.
How to use the Request Header Inspector
- 1Paste the raw header block from your logs or dev tools.
- 2Read the parsed table with per-header explanations.
- 3Check the security notes for anything missing.
Frequently asked questions
Which security headers should a response include?
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and a sensible frame policy cover most needs.
Which headers matter most when something is not working?
Content-Type, because a mismatch between what you send and what the server expects accounts for a large share of failures; Authorization, for anything that returns 401; Accept, when you get the wrong representation back; and the cache headers when a stale response will not go away. The rest are usually noise until one of those is right.
Are header names case-sensitive?
No. HTTP header field names are case-insensitive, so Content-Type, content-type and CONTENT-TYPE are the same header, and HTTP/2 requires them lowercase on the wire. Values, however, can be case-sensitive depending on the header, which catches people out.
Why do I see headers I did not send?
Proxies, load balancers and CDNs add their own on the way through: X-Forwarded-For, X-Real-IP, CF-Ray and similar. Anything beginning X-Forwarded describes the hop rather than the original client, and should never be trusted for security decisions without knowing exactly which proxy set it.