A Small HTTP Header Check with curl

When checking cache rules, redirects, content types, or security headers, start with the response the server actually sends.

This performs a GET request, prints response headers, and discards the body:

curl --silent --show-error \
  --dump-header - \
  --output /dev/null \
  https://example.com/

Using GET matters because some applications implement HEAD differently or not at all. curl --head is convenient, but a header-only response is not always identical to the headers returned for a normal page request.

To follow redirects and show every response header block:

curl --location --silent --show-error \
  --dump-header - \
  --output /dev/null \
  https://example.com/old-path

Add a compact final summary:

curl --location --silent --show-error \
  --dump-header - \
  --output /dev/null \
  --write-out 'final=%{url_effective} status=%{http_code}\n' \
  https://example.com/old-path

Look for duplicated or contradictory headers as well as missing ones. A CDN and origin can both add Cache-Control; a proxy may rewrite Location; multiple policies may arrive in separate Content-Security-Policy headers.

Remember that the result depends on request details. Hostname, scheme, path, cookies, authorization, user agent, and Accept-Encoding can change the response. Reproduce the relevant request without putting secrets directly into shell history or a shared transcript.

For automated monitoring, test one explicit property rather than diffing the entire header set, which often contains dates, request IDs, and other naturally changing values.

Reference

• curl man page

Cover photo: Unsplash.