HTTP Response Headers Inspector
Check HTTP status codes (200, 301, 404), server technologies, compression, and security headers (CSP, HSTS).
HTTP Response for twitter.com
HTTP/1.1 200 OK| Header Field | Value |
|---|---|
| Status | HTTP/1.1 200 OK |
| Date | Tue, 06 Oct 2026 21:11:40 GMT |
| Content-Type | text/html; charset=UTF-8 |
| Connection | close |
| perf | 7402827104 |
| Server | cloudflare envoy |
| x-server | x-web |
| Cache-Control | no-cache, no-store, max-age=0 |
| referrer-policy | strict-origin-when-cross-origin |
| x-frame-options | SAMEORIGIN |
| x-transaction-id | e44f07a705878a61 |
| x-xss-protection | 0 |
| x-download-options | noopen |
| origin-agent-cluster | ?1 |
| x-content-type-options | nosniff |
| x-dns-prefetch-control | off |
| content-security-policy | default-src 'self';script-src 'self' 'nonce-a53JWZtPYjF1/0resWA08A==' 'unsafe-inline' 'wasm-unsafe-eval' 'report-sample' https://*.twimg.com https://abs.twimg.com https://accounts.google.com/gsi/client https://appleid.cdn-apple.com https://*.stripe.com https://cdn.plaid.com/link/v2/stable/link-initialize.js https://sdk.dv.socure.io/latest/device-risk-sdk.js https://cdn.getpinwheel.com/pinwheel-v3.2.1.js https://*.x.com https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com;script-src-attr 'none' 'report-sample';style-src 'self' 'unsafe-inline' https://*.twimg.com https://accounts.google.com/gsi/style;style-src-elem 'self' 'unsafe-inline' https://*.twimg.com https://accounts.google.com/gsi/style;img-src 'self' https://x.com:443 https://twitter.com https://*.twimg.com https://*.pscp.tv https://*.video.pscp.tv https://abs.twimg.com data: blob: https://play-lh.googleusercontent.com https://img.youtube.com https://i.ytimg.com https://ton.twitter.com/twitter-assets/ https://ton.twitter.com/onboarding/ https://cm.g.doubleclick.net https://analytics.twitter.com https://*.plaid.com https://assets.grok.com https://computer-hub.grok.com https://*.grokusercontent.com https://*.gstatic.com https://serpapi.com https://*.grok.me https://media.riffsy.com https://*.giphy.com https://media.tenor.com https://c.tenor.com https://cdn.7tv.app https://js.intercomcdn.com https://static.intercomassets.com https://downloads.intercomcdn.com https://downloads.intercomcdn.eu https://downloads.au.intercomcdn.com https://uploads.intercomusercontent.com https://gifs.intercomcdn.com https://video-messages.intercomcdn.com https://messenger-apps.intercom.io https://messenger-apps.eu.intercom.io https://messenger-apps.au.intercom.io https://*.intercom-attachments-1.com https://*.intercom-attachments.eu https://*.au.intercom-attachments.com https://*.intercom-attachments-2.com https://*.intercom-attachments-3.com https://*.intercom-attachments-4.com https://*.intercom-attachments-5.com https://*.intercom-attachments-6.com https://*.intercom-attachments-7.com https://*.intercom-attachments-8.com https://*.intercom-attachments-9.com https://static.intercomassets.eu https://static.au.intercomassets.com;manifest-src 'self' https://x.com:443;font-src 'self' https://*.twimg.com data: https://js.intercomcdn.com https://fonts.intercomcdn.com;media-src 'self' https://*.twimg.com https://*.pscp.tv https://*.video.pscp.tv blob: data: https://*.watch.x.com https://js.intercomcdn.com https://downloads.intercomcdn.com https://downloads.intercomcdn.eu https://downloads.au.intercomcdn.com;connect-src 'self' https://api.x.com https://api.twitter.com https://t.co https://*.twimg.com https://*.pscp.tv https://*.video.pscp.tv wss://*.pscp.tv https://upload.x.com https://sentry.io https://*.sentry.io wss://localhost.x.com:* https://m.castle.io wss://chat-ws.x.com https://*.x.com https://accounts.google.com/gsi/ https://csi.gstatic.com https://appleid.cdn-apple.com https://appleid.apple.com https://places.googleapis.com https://*.prelude.dev data: https://analytics.twitter.com https://*.stripe.com https://*.plaid.com https://*.dv.socure.io https://checkoutshopper-live.adyen.com https://grok.com https://*.grok.com wss://grok.com wss://*.grok.com wss://*.cursorvm.com https://*.x.ai wss://*.x.ai https://storage.googleapis.com https://media.riffsy.com https://*.giphy.com https://media.tenor.com https://c.tenor.com https://7tv.io wss://events.7tv.io https://cognito-identity.us-east-1.amazonaws.com https://streaming-rekognition.us-east-1.amazonaws.com wss://streaming-rekognition.us-east-1.amazonaws.com https://cdn.liveness.rekognition.amazonaws.com https://via.intercom.io https://api.intercom.io https://api.au.intercom.io https://api.eu.intercom.io https://api-iam.intercom.io https://api-iam.eu.intercom.io https://api-iam.au.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io wss://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io wss://nexus-websocket-b.intercom.io https://nexus-europe-websocket.intercom.io wss://nexus-europe-websocket.intercom.io https://nexus-australia-websocket.intercom.io wss://nexus-australia-websocket.intercom.io https://uploads.intercomcdn.com https://uploads.intercomcdn.eu https://uploads.au.intercomcdn.com https://uploads.eu.intercomcdn.com https://uploads.intercomusercontent.com;frame-src 'self' https://accounts.google.com https://appleid.apple.com https://www.youtube.com https://w.soundcloud.com https://www.pscp.tv https://platform.twitter.com https://platform.x.com https://studio.x.com https://studio-dev.x.com https://iframe.arkoselabs.com https://*.x.com https://*.crbcos.com https://*.plaid.com https://*.stripe.com https://cdn.getpinwheel.com/ https://checkoutshopper-live.adyen.com https://artifacts.grokusercontent.com https://intercom-sheets.com https://www.intercom-reporting.com https://player.vimeo.com https://fast.wistia.net;worker-src 'self' blob: https://*.twimg.com https://abs.twimg.com;frame-ancestors 'self' https://x.com https://x.com:443 https://twitter.com https://twitter.com:443;base-uri 'self';form-action 'self' https://accounts.google.com https://intercom.help https://api-iam.intercom.io https://api-iam.eu.intercom.io https://api-iam.au.intercom.io;object-src 'none';upgrade-insecure-requests |
| cross-origin-opener-policy | same-origin-allow-popups |
| cross-origin-resource-policy | same-origin |
| x-permitted-cross-domain-policies | none |
| x-response-time | 46 |
| origin-cf-ray | a467a8ec3e2aae8f-DEL |
| strict-transport-security | max-age=631138519; includeSubdomains |
| x-served-by | t4_p |
| vary | Accept-Encoding |
| cf-cache-status | DYNAMIC |
| Set-Cookie | guest_id_marketing=v1%3A179132110037349816; Max-Age=63072000; Expires=Thu, 05 Oct 2028 21:11:40 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None, guest_id_ads=v1%3A179132110037349816; Max-Age=63072000; Expires=Thu, 05 Oct 2028 21:11:40 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None, gt=2107579567108161924; Max-Age=9000; Expires=Tue, 06 Oct 2026 23:41:40 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=Lax, personalization_id="v1_hLfxMkP5NtZx3ahiixmPxw=="; Max-Age=63072000; Expires=Thu, 05 Oct 2028 21:11:40 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None, guest_id=v1%3A179132110037349816; Max-Age=63072000; Expires=Thu, 05 Oct 2028 21:11:40 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None, ct0=; Max-Age=-1791321099; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=Lax |
| set-cookie | __cf_bm=EdLa20802KO2VlDk_JxDNiMYvlzIklD2lEqRMAywf74-1791321100.2007997-1.0.1.1-kFYgQVDUxAbb_rO0NhQKmgQQG6vif3EN4AbPzdbuzCOVMElZkrftQuZ9xAtEYbX285egUz55jD8BE.puQeWMN.Nr27r7SdZC0wI3N0I.3Bh7srkUuKOx7XSi12GvIP6O; HttpOnly; SameSite=None; Secure; Path=/; Domain=twitter.com; Expires=Tue, 06 Oct 2026 21:41:40 GMT |
| CF-RAY | a467a8ec3e2aae8f-DEL |