Reading HTTP response headers: a practical guide

Every time a browser loads a page, the server answers with a set of HTTP response headers — metadata that travels alongside the content and tells the browser how to handle it. Headers control caching, security, content type, compression and redirects. Learning to read them turns a lot of "why is this happening?" mysteries into two-minute diagnoses. Here's the practical tour.

How to see the headers

The quickest command-line view:

curl -sI https://example.com

-I fetches just the headers (a HEAD request); -s keeps it quiet. To follow redirects and see each hop, add -L and drop to a full request:

curl -sIL https://example.com

In a browser, open DevTools → Network, click the request, and read the Response Headers panel.

The status line comes first

Before the headers, the server sends a status code. The families:

• 2xx — success (200 OK, 204 No Content).
• 3xx — redirection (301 permanent, 302 temporary, 304 Not Modified from cache).
• 4xx — client error (404 Not Found, 403 Forbidden, 429 Too Many Requests).
• 5xx — server error (500, 502 Bad Gateway, 503 Service Unavailable).

A 301 vs 302 matters for SEO — permanent redirects pass ranking signals; temporary ones don't.

Content headers

• Content-Type — the format and character set, e.g. text/html; charset=utf-8 or application/json. A wrong Content-Type is why a JSON API sometimes renders as plain text or a download prompt appears instead of a page.
• Content-Length — the body size in bytes.
• Content-Encoding — compression, usually gzip or br (Brotli). If this is missing on large text responses, you're shipping bytes you don't need to.

Caching headers — the performance lever

• Cache-Control — the master switch: max-age=3600 (cache for an hour), no-store (never cache), public/private, immutable (never revalidate versioned assets).
• ETag and Last-Modified — fingerprints the browser sends back so the server can reply 304 Not Modified and skip re-sending unchanged content.
• Expires — an older absolute-time cache directive, superseded by Cache-Control but still seen.

Static assets should have long max-age; HTML pages usually shouldn't be cached hard, or users won't see updates.

Security headers — check these on every site

These headers are how a site defends itself in the browser:

• Strict-Transport-Security (HSTS) — forces HTTPS for future visits: max-age=31536000; includeSubDomains. Prevents downgrade attacks.
• Content-Security-Policy (CSP) — restricts which scripts, styles and sources may load; the strongest defence against cross-site scripting.
• X-Content-Type-Options: nosniff — stops the browser guessing (and mis-executing) content types.
• X-Frame-Options or CSP frame-ancestors — prevents your site being embedded in an iframe (clickjacking protection).
• Referrer-Policy — controls how much of the referring URL is shared with other sites.

A quick header scan tells you at a glance whether a site has its security basics in place. Missing HSTS or CSP on a production site is a common, easily fixed gap.

Informational and identity headers

• Server — the software (e.g. nginx). Some operators hide this to reveal less to attackers.
• Set-Cookie — issues cookies; watch for the Secure, HttpOnly and SameSite flags, which matter for session security.
• Location — on a 3xx response, the URL being redirected to. Follow the chain to catch redirect loops or unexpected hops.
• Access-Control-Allow-Origin — the CORS header that decides whether another site's JavaScript may read the response. The usual suspect behind "blocked by CORS policy" errors.

What headers help you diagnose

• Site not updating? Check Cache-Control and ETag — something is caching aggressively.
• Redirect loop? Follow Location across hops.
• CORS error? Inspect Access-Control-Allow-Origin on the response.
• Mixed HTTP/HTTPS issues? Look for Strict-Transport-Security and the redirect from http to https.
• Slow, heavy pages? Confirm Content-Encoding compression is on.

Inspect any URL's headers

Our free HTTP header checker at /tools/http-headers fetches any URL and lays out every response header — status, caching, content type, security headers and redirects — in a readable format. It's the fastest way to audit a deploy, confirm your security headers, or debug a caching or CORS problem.

When you control the server, you control the headers. On a Nxeon VPS with full root you can set caching, HSTS and CSP exactly how you want in Nginx or your app — no shared-hosting restrictions. See /vps.