HTTP Response Headers Inspector

Check HTTP status codes (200, 301, 404), server technologies, compression, and security headers (CSP, HSTS).

📑

HTTP Response for instagram.com

HTTP/1.1 200 OK
Header Field Value
Status HTTP/1.1 200 OK
Vary Accept-Encoding, Sec-Fetch-Site, Sec-Fetch-Mode, Accept-Encoding
Location https://www.instagram.com/
Strict-Transport-Security max-age=31536000; preload; includeSubDomains, max-age=31536000; preload; includeSubDomains
x-stack www, www
Content-Type text/html; charset="utf-8", text/html; charset="utf-8"
X-FB-Debug bNLZ9Y802W8aGsYZqy91zB4UKOwoEx5Up6n7gOVsEhwI9+JB3XyYyg/fGJJHph6PoASsDWdLPU/Dz10uysqJrA==, Nq6d8A1XcDMg1mbJbs0SE29TVIBgIazJBNZoKH8fsFj70lenISIg4wpoIQZDWSCwWvyRHKR7CNqnhDk+mhm7vQ==
Date Wed, 07 Oct 2026 02:01:57 GMT, Wed, 07 Oct 2026 02:01:57 GMT
Alt-Svc h3=":443"; ma=86400, h3=":443"; ma=86400
X-FB-Connection-Quality EXCELLENT; q=0.9, rtt=27, rtx=0, c=14, mss=1380, tbw=3376, tp=-1, tpl=-1, uplat=228, ullat=0, EXCELLENT; q=0.9, rtt=24, rtx=0, c=14, mss=1380, tbw=3713, tp=-1, tpl=-1, uplat=355, ullat=0
Connection close, close
Content-Length 0
Set-Cookie csrftoken=NNG_na16ub7l4YnyJhniEt; expires=Thu, 11-Nov-2027 02:01:57 GMT; Max-Age=34560000; path=/; domain=.instagram.com; secure; SameSite=None, mid=asWoFQALAAHm39hQlUryQaNc9o3r; expires=Thu, 11-Nov-2027 02:01:57 GMT; Max-Age=34560000; path=/; domain=.instagram.com; secure; httponly; SameSite=None
accept-ch-lifetime 4838400
accept-ch viewport-width,dpr,Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model
Pragma no-cache
Cache-Control private, no-cache, no-store, must-revalidate
Expires Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy default-src *.facebook.com *.fbcdn.net *.instagram.com blob:;script-src *.instagram.com static.cdninstagram.com z-p42-static.cdninstagram.com https://instagram.com https://*.www.instagram.com https://*.cdninstagram.com wss://www.instagram.com blob: *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-cuMPWkmv' 'self' 'wasm-unsafe-eval' https://*.google-analytics.com https://translate.google.com https://apis.google.com https://accounts.google.com;style-src *.instagram.com static.cdninstagram.com z-p42-static.cdninstagram.com https://*.www.instagram.com data: blob: 'unsafe-inline' *.fbcdn.net *.facebook.com https://accounts.google.com;connect-src *.instagram.com wss://edge-chat.instagram.com connect.facebook.net https://instagram.com https://*.www.instagram.com https://*.graph.instagram.com https://*.i.instagram.com https://*.od.instagram.com https://i.threads.net https://i.threads.com https://*.od.threads.net https://*.od.threads.com wss://www.instagram.com blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* ws://localhost:* *.cdninstagram.com wss://*.instagram.com:* 'self' *.ipification.com https://accounts.google.com;font-src *.instagram.com static.cdninstagram.com z-p42-static.cdninstagram.com data: *.fbcdn.net *.intern.facebook.com *.facebook.com https://*.cdninstagram.com https://fonts.gstatic.com;img-src *.instagram.com *.facebook.com *.fbcdn.net data: *.cdninstagram.com *.whatsapp.net blob: https://*.threads.net https://*.threads.com *.fbsbx.com android-webview-video-poster: *.oculuscdn.com *.giphy.com *.tenor.co *.tenor.com www.googleadservices.com *.doubleclick.net *.google.com *.google.co.uk https://www.gstatic.com https://*.google-analytics.com;media-src *.facebook.com *.fbcdn.net *.instagram.com *.cdninstagram.com *.fbsbx.com data: blob: https://*.giphy.com *.tenor.co *.tenor.com;child-src *.facebook.com *.fbcdn.net *.instagram.com data: blob:;frame-src https://instagram.com https://connect.facebook.net *.instagram.com *.facebook.com *.fbsbx.com fbsbx.com data: *.ipification.com www.googleadservices.com *.doubleclick.net *.google.com *.google.co.uk;manifest-src *.facebook.com *.fbcdn.net *.instagram.com data: blob:;object-src *.facebook.com *.fbcdn.net *.instagram.com data: blob:;block-all-mixed-content;upgrade-insecure-requests;
document-policy include-js-call-stacks-in-crash-reports
X-Frame-Options DENY
X-Content-Type-Options nosniff
X-XSS-Protection 0
reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.instagram.com/error/ig_web_error_reports/?device_level=unknown&brsid=7693740347575679644&cpp=C3&cv=1049506688&st=1791338517830"
report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.instagram.com\/error\/ig_web_error_reports\/?device_level=unknown&brsid=7693740347575679644&cpp=C3&cv=1049506688&st=1791338517830"}]}
cross-origin-embedder-policy-report-only require-corp;report-to="coep_report"
cross-origin-opener-policy same-origin-allow-popups
origin-agent-cluster ?1