ipyellow

HTTP header viewer

Exact-IP fetch

Inspect response metadata without downloading the response body, while revalidating every redirect against public-address and default-port rules.

Only default HTTP/HTTPS ports are allowed. DNS is pinned to one validated public address per hop, redirects are manual and limited to five, and the total deadline is 15 seconds.

No URL inspected yetEnter an absolute public HTTP or HTTPS URL. Private targets, credentials, custom ports, unsafe redirects, and redirect loops are blocked.

Fetch and interpretation limits

The inspector tries HEAD first and falls back to a body-streaming GET only when the server rejects HEAD; in either case it stops after response headers and does not buffer the body. It sends no visitor cookies, authorization, referrer, or browser headers, disables environment proxies, and connects to the exact public address validated for each URL in the chain.

Header names are preserved, but control characters and oversized values are bounded. Set-Cookie values are always redacted before display or caching. Query-string URLs are never cached; other successful results may remain in shared application memory for five minutes. Missing security headers are observations, not automatic proof of a vulnerability, because appropriate policy depends on the application.

Back to tools