HTTP 标头
浏览器随本页面发送的标头，以及任意公开 URL 响应标头的检查工具。
检查 URL
你的请求
浏览器随本页面发送的标头。不显示我们自己代理添加的标头。不保存任何内容。
| 标头 | 值 |
|---|---|
| accept | */* |
| accept-encoding | gzip, br |
| user-agent | Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected]) |
此内容尚无中文版本。在发布译文之前以英语显示。
Every HTTP response starts with headers: the status code, the content type, caching rules, cookies and — increasingly — security policies. This tool requests a public URL once, reads the headers and closes the connection without downloading the body. Redirects are shown, not followed, so you can inspect each step yourself.
The security-header overview checks for the usual browser protections: HSTS (HTTPS only), Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. A missing header is not automatically a vulnerability; it means the browser falls back to its default behaviour.
Below, you also see the request headers your own browser sent to load this page.
常见问题
Why does the checker get a different result than my browser?
Servers may vary responses by user agent, language, cookies or location. The checker sends no cookies and a neutral user agent.
Which addresses can be checked?
Only public hosts on the standard ports 80 and 443. Private, internal and reserved addresses are refused before any connection is made.