Every web response carries a stack of HTTP headers — metadata about the response separate from the body. Most users never see them. For diagnostics, they're a goldmine: they reveal the server software, security posture, caching strategy, and (sometimes) which framework is behind the page.
The five headers worth inspecting
- Server. Identifies the web server.
nginx/1.18.0is a version-leak;cloudflaremeans the request hit a CDN edge. - Strict-Transport-Security (HSTS). Tells the browser to never speak HTTP to this domain. Missing on production is a real gap.
- Content-Security-Policy. Restricts which scripts/styles/images the page can load. The most effective single header against XSS.
- X-Frame-Options. Prevents clickjacking by refusing to be loaded in an iframe.
- Cache-Control. Tells the browser and CDN how long to keep the response.
Our HTTP Header Inspector shows the full response set + a security-header audit.