HTTP Header Check
Reads all HTTP response headers of a web address and analyzes their status.
Guide & best practices
HTTP Header Check for status codes, caching and CORS
Inspect raw HTTP response headers, understand caching, encoding and CORS and spot information disclosure quickly.
Typical use cases
Helps debug caching, CDN behaviour, CORS errors, cookie flags, compression and unwanted technology headers.
How Balou reads HTTP headers
Balou fetches the URL and shows the status code plus relevant response headers in a structured view, including caching, CORS and encoding hints.
HTTP header best practices
Set meaningful Cache-Control directives, enable gzip/br, secure cookies with flags and hide unnecessary server/technology headers.
Frequently asked questions
Which HTTP status codes matter?
200 (OK), 301 (moved permanently), 304 (not modified), 403 (forbidden), 404 (not found) and 500 (server error) are the most common.
What does Cache-Control control?
Cache duration and visibility, e.g. “max-age=3600, public” to cache or “no-store” to forbid caching.
How does CORS work via headers?
The server allows cross-origin access with “Access-Control-Allow-Origin: https://app.example.com” plus additional allow headers.
Should I hide X-Powered-By and Server?
Yes, removing them reduces information disclosure and makes targeted version-based attacks harder.