Justin Cooney

Today I was checking into how best to look at the HTTP headers that get returned from a site. I was checking based on a site security report that was asking me to look into several headers that seemed to be getting returned but that I wanted to verify.

After searching around a bit, and looking at various tools I came to the conclusion that the best option is to use either curl or PowerShell. These two tools give you the most control over your query but are straightforward to run on any computer.

CURL Query a Site HTTP Headers

If you have Windows 11 or 10 you can run curl from the command prompt. Otherwise for older systems you can download and run curl with minimum fuss.

To do a simple site https headers query with curl enter:

curl -I https://example.com

To see some more details you can set curl to return more verbose output: with the -v switch

curl -I -v https://example.com

PowerShell Query a Site HTTP Headers

You can directly open a PowerShell prompt and type in your query to get the results. Before I give more details here is the code for a PowerShell query to list the HTTP Headers of the site example.com

# Query host headers for the website https://example.com
$uri = "https://example.com/"
$response = Invoke-WebRequest -Uri $uri -Method Head

# Display the host headers
$response.Headers

I like to play around with code and didn’t have Visual Studio Code installed which I’ve heard can be a great PowerShell code editor. So I downloaded Visual Studio Code and set up CoPilot AI assistant with a bunch of its features just for fun.

For the PowerShell part I downloaded and installed two Extensions:

1. The latest Microsoft PowerShell Library: If you search for PowerShell under Extensions, the official Microsoft one should show up as the first result. I ended up downloading the linked .ZIP and doing the installation from there.
2. I liked the sound of the Extension called ‘Run in PowerShell‘ that let’s you run your code in a new CMD prompt outside of Visual Studio Code.

How it Worked Out

Both curl and PowerShell returned the same HTTP host header results. Both are very reliable tools free from adware and of course very customizable.

For a simple no-nonsense query, I think curl is best since it can be a simple one-line query in a CMD prompt. Also the verbose output version was interesting to look through.

On the other hand, the PowerShell option gives you the full control of a programming language.