HTTP Header Inspector

13 headers parsed. 13 explained from knowledge base.

• Content-Type
  text/html; charset=utf-8

  MIME type of the body. text/html; charset=utf-8 is the common HTML case.

• Content-Length
  4823

  Body size in bytes. Wrong value = browser hang or truncation.

• Cache-Control
  public, max-age=300, stale-while-revalidate=86400

  Caching directives. Common: max-age=N, no-cache (revalidate), no-store (don't save), private/public.

• ETag
  "8f3c9a-1856"

  Opaque identifier for this resource version. Pair with If-None-Match for conditional GETs.

• Strict-Transport-Security
  max-age=31536000; includeSubDomains

  HSTS — force HTTPS for max-age seconds. includeSubDomains expands the scope.

• Content-Security-Policy
  default-src 'self'

  Browser-enforced allowlist for scripts, styles, frames, etc. Major XSS defense.

• X-Frame-Options
  SAMEORIGIN

  DENY or SAMEORIGIN. Stops clickjacking by blocking iframe embedding. Largely superseded by CSP frame-ancestors.

• X-Content-Type-Options
  nosniff

  nosniff = browser won't MIME-sniff the body. Defense against script injection via misclassified files.

• Access-Control-Allow-Origin
  *

  CORS — which origin(s) may read this response. '*' or specific origin.

• Vary
  Accept-Encoding, Cookie

  Tells caches which request headers affect the response. Important for CDN cache keys.

• Set-CookieSensitive — don't log
  sid=abc123; HttpOnly; Secure; SameSite=Strict

  Server tells the browser to store this cookie. Watch for HttpOnly, Secure, SameSite, Domain.

• X-RateLimit-Limit
  1000

  Rate limiting — total allowed requests per window. Pair with x-ratelimit-remaining and x-ratelimit-reset.

• X-RateLimit-Remaining
  987

  Requests left in the current window.

Knowledge base covers ~30 common headers. Unrecognised headers still parse but won't get an explanation. For HTTP status code meanings, see the HTTP status code lookup.