HTTP Headers API

Q: How can I check if a site sends HSTS or CSP?

Look at `security_headers` in the response: each of the six common security headers has its value or `null` when missing.

Q: Can I send a HEAD request instead of GET?

Yes, add `method=HEAD`. Some servers answer HEAD differently, so GET is the default.

Q: Are redirects followed?

Yes. The headers are those of the final response; the `redirects` array lists each intermediate URL and status.

See the HTTP status and every response header of a URL, with a summary of security headers like HSTS, CSP and X-Frame-Options.

GETPOSThttps://apibox.io.vn/v1/http-headers

Web & SEO▶ Try it online

Give a public url and the API requests it (GET by default, or method=HEAD), follows redirects and returns the final URL, HTTP status, redirect chain, response time and all response headers as a lowercase key/value object. Only the headers are read; the body is not downloaded.

A security_headers object shows the value of strict-transport-security, content-security-policy, x-frame-options, x-content-type-options, referrer-policy and permissions-policy, or null when a header is missing, which makes it easy to audit a site security setup.

Requests use a 10 second timeout and at most 8 redirects; only public http/https hosts on ports 80, 443, 8080 and 8443 are allowed.

Parameters

Name	In	Type	Required	Default
`url`	body\|query	string	yes		Public http/https URL to check (max 4096 characters).
`method`	body\|query	string	no	`GET`	HTTP method used for the check: `GET` or `HEAD`.

Example

curl "https://apibox.io.vn/v1/http-headers?url=https://example.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/http-headers?url=https://example.com', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/http-headers?url=https://example.com",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/http-headers?url=https://example.com');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "url": "https://example.com",
  "final_url": "https://example.com/",
  "status": 200,
  "redirects": [],
  "response_ms": 172,
  "headers": {
    "accept-ranges": "bytes",
    "age": "8",
    "allow": "GET, HEAD",
    "cf-cache-status": "HIT",
    "connection": "keep-alive",
    "content-type": "text/html; charset=utf-8",
    "date": "Tue, 10 Nov 2026 05:08:29 GMT",
    "last-modified": "Sun, 08 Nov 2026 18:05:34 GMT",
    "server": "cloudflare",
    "transfer-encoding": "chunked"
  },
  "security_headers": {
    "strict-transport-security": null,
    "content-security-policy": null,
    "x-frame-options": null,
    "x-content-type-options": null,
    "referrer-policy": null,
    "permissions-policy": null
  }
}

Use cases

Audit security headers (HSTS, CSP, X-Frame-Options) of a website
Debug caching headers such as cache-control, age and etag
Check which server or CDN answers for a domain
Monitor content-type and status codes of API endpoints

FAQ

How can I check if a site sends HSTS or CSP?

Look at security_headers in the response: each of the six common security headers has its value or null when missing.

Can I send a HEAD request instead of GET?

Yes, add method=HEAD. Some servers answer HEAD differently, so GET is the default.

Are redirects followed?

Yes. The headers are those of the final response; the redirects array lists each intermediate URL and status.

HTTP Headers API

Parameters

Example

Response

Use cases

FAQ

Related APIs

URL Metadata

Redirect Checker

robots.txt Parser