Why do I see different headers than in my browser?

The request comes from different infrastructure with different headers, no cookies and no browser fingerprint. Servers, CDNs and WAFs routinely vary responses on exactly those inputs.

Which security headers should I be sending?

Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options: nosniff, Referrer-Policy and a restrictive Permissions-Policy. CSP delivers the most value and takes the most effort to get right.

What is the difference between no-cache and no-store?

no-cache permits storage but requires revalidation before reuse. no-store forbids storing the response at all, which is what you want for sensitive pages.

Can I see request headers too?

This shows the response. To inspect what your own client sends, use your browser's network panel — the server sees only what your client chose to send.

Network & DNS🌐 YAS server-sideAPI availableintermediate

HTTP Header Viewer

Fetches a URL and shows its HTTP response headers.

Processed by YAS · not stored

Ready to runInstant execution

All tools →

Result

—

What does this tool do?

Fetches a URL and shows its HTTP response headers.

Why would I use it?

You want to inspect security headers (CSP, HSTS) of a site.
You are debugging why a request behaves oddly.
You want to see caching and content-type headers.

Real-life example

Input

https://example.com

Output

content-type: text/html
strict-transport-security: max-age=...
cache-control: ...

Headers are listed in a readable table.

Input → Process → Output → Next

Input: Enter a URL.
Process: YAS fetches the URL with SSRF-safe checks and reads headers.
Output: The response headers.
Next action: Check for missing security headers (CSP, HSTS, X-Content-Type-Options).

Common mistakes

Fetching URLs that block bots or require auth.
Expecting headers from a page rendered by JavaScript.
Using it on internal/private hosts (blocked for security).

What the result means

Headers control caching, security and content negotiation.

Privacy & security

Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.

API

Endpoint

POST https://yas.sh/api/v1/tools/http-header-viewer

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/http-header-viewer" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/http-header-viewer", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "url": "https://example.com"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/http-header-viewer", json={"url":"https://example.com"})
data = r.json()

Field	Type	Required	Description
url	string	Yes	http/https URL

Success response

{ "url": "https://example.com", "status": 200, "headers": { "content-type": "text/html", ... } }

Send a HEAD/GET to a URL and return sanitized response headers.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How HTTP Header Viewer works

The tool issues a request to the URL and reports the status line and full response header set without rendering the body. Headers are where the operational truth lives: caching directives, content type and encoding, redirect targets, cookie attributes, CORS policy, and the security headers that govern how a browser treats the document.

Header semantics interact in ways that are easy to get wrong. Cache-Control overrides Expires; a Vary header changes what a shared cache may reuse; Content-Type's charset parameter determines how bytes are decoded regardless of any meta tag; and Set-Cookie attributes (Secure, HttpOnly, SameSite, Domain, Path) decide whether a cookie is sent at all. Reading the raw headers is the only way to see what the server actually sent rather than what the framework claims to send.

When to use it: real-world scenarios

Debugging why a page is not being cached

A single no-store from a middleware, or a Vary on a header that always differs, defeats an entire CDN configuration. The response headers show which layer added it.

Verifying security headers before an audit

Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options and Referrer-Policy either arrive on the response or they do not. Configuration files can lie; headers cannot.

Tracing a redirect chain

Status codes and Location headers reveal whether a redirect is permanent, whether HTTPS upgrade happens before or after the www redirect, and how many hops users pay for.

Diagnosing a CORS failure

Access-Control-Allow-Origin and the preflight response headers show exactly which part of the policy the browser rejected.

Pro tips

Compare headers from a browser request with those from a plain fetch. Differences point to logic keyed on User-Agent, Accept or cookies.
Cache-Control: no-cache does not mean 'do not cache' — it means revalidate before reuse. no-store is the directive that forbids storage.
Set Strict-Transport-Security only once you are certain about HTTPS everywhere; a long max-age is difficult to unwind because browsers remember it.
Check for a Vary: Accept-Encoding header on compressed responses, or shared caches may serve the wrong encoding to some clients.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Requests originate from YAS infrastructure, so geo-targeted, cookie-dependent or bot-filtered responses may differ from what you see.
The response body is not rendered, so headers set by client-side JavaScript or meta tags are not represented.
Hosts behind authentication, IP allowlists or aggressive WAF rules may refuse the request entirely.
HTTP/2 and HTTP/3 header names are lowercase on the wire; casing shown is normalised.

Frequently asked questions

Why do I see different headers than in my browser?: The request comes from different infrastructure with different headers, no cookies and no browser fingerprint. Servers, CDNs and WAFs routinely vary responses on exactly those inputs.
Which security headers should I be sending?: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options: nosniff, Referrer-Policy and a restrictive Permissions-Policy. CSP delivers the most value and takes the most effort to get right.
What is the difference between no-cache and no-store?: no-cache permits storage but requires revalidation before reuse. no-store forbids storing the response at all, which is what you want for sensitive pages.
Can I see request headers too?: This shows the response. To inspect what your own client sends, use your browser's network panel — the server sees only what your client chose to send.