Can I send custom headers?

Yes, both standard ones (Authorization, Content-Type, User-Agent) and custom X-headers. The browser blocks a few "forbidden" headers such as Host, Origin and Connection for security reasons; you need curl or a server-side tool to set those.

Will I be blocked by CORS?

Yes, if the target server does not allow your origin. The tool still attempts the request and reports if the browser blocked the response. For CORS-specific diagnostics use our dedicated CORS tester.

Can I test HTTP instead of HTTPS?

This page is served over HTTPS, and modern browsers block "mixed content" requests from HTTPS to HTTP. To test plain-HTTP endpoints run the tool locally or use curl.

What does a 200 with empty body mean?

The request succeeded but there is nothing to return. Common for HEAD, DELETE and some POST endpoints that just confirm. Check for Content-Length: 0 and that Content-Type is missing.

HTTP Request Tester - GET, POST, PUT, DELETE

About the HTTP tester

The request is sent directly from your browser using fetch(). This means it is subject to the browser’s CORS rules: the server you call must allow cross-origin requests, otherwise the response is blocked.

The tool is suited for testing open APIs that allow CORS. For private APIs, use a server-side tool such as curl or Postman.

About this tool

The HTTP tester lets you send HTTP requests to any URL and see the complete response: status code, every header, body, timing and redirect chain. Handy when debugging an API endpoint, verifying a cache header, checking that a redirect chain lands somewhere sensible, or inspecting a webhook response. Similar to curl or Postman, but right in the browser with no install. All traffic goes from your browser; nothing is proxied through our server.

How to use it

Type in the full URL and pick the HTTP method.
Add headers and, if needed, a request body.
Click "Send" to run the request.
Inspect status code, headers, body and timing in the response panel.

Examples

Check cache headers

InputGET https://cdn.example.com/logo.png

Output

Status: 200 OK
Cache-Control: public, max-age=31536000, immutable
ETag: "abc123"
CF-Cache-Status: HIT

Follow redirect chain

InputGET http://example.com

Output

1) 301 -> https://example.com
2) 302 -> https://www.example.com
3) 200 OK

The tool shows every hop, not just the final response. Useful for spotting unnecessary redirects.

Common use cases

Debug API endpoints during development.
Verify cache headers and TTL on CDN assets.
Check HTTPS upgrades and HSTS headers.
Test webhook endpoints without triggering the full integration.
Map redirect chains for SEO and performance.

Frequently asked questions

Can I send custom headers?: Yes, both standard ones (Authorization, Content-Type, User-Agent) and custom X-headers. The browser blocks a few "forbidden" headers such as Host, Origin and Connection for security reasons; you need curl or a server-side tool to set those.
Will I be blocked by CORS?: Yes, if the target server does not allow your origin. The tool still attempts the request and reports if the browser blocked the response. For CORS-specific diagnostics use our dedicated CORS tester.
Can I test HTTP instead of HTTPS?: This page is served over HTTPS, and modern browsers block "mixed content" requests from HTTPS to HTTP. To test plain-HTTP endpoints run the tool locally or use curl.
What does a 200 with empty body mean?: The request succeeded but there is nothing to return. Common for HEAD, DELETE and some POST endpoints that just confirm. Check for Content-Length: 0 and that Content-Type is missing.

Technical background

HTTP (now HTTP/1.1, HTTP/2 and HTTP/3) consists of a request line with method and URL, headers, a blank line and an optional body. Methods define intent: GET fetches, POST creates or submits, PUT replaces, PATCH partially updates, DELETE removes, HEAD is GET without a body, OPTIONS describes what’s allowed. Status codes are grouped 1xx (informational), 2xx (success), 3xx (redirect), 4xx (client error), 5xx (server error). Key headers: Content-Type gives the format (application/json, text/html), Content-Length the byte count, Cache-Control the caching rules, ETag a version tag for validation, Authorization for auth (Bearer, Basic), Accept what the client accepts, Accept-Encoding compression (gzip, br). HTTP/2 and HTTP/3 are binary protocols that multiplex many requests over one connection for lower latency. The tool uses the browser fetch() API which follows redirects automatically unless you disable it. Timing is measured from fetch() start until the response is fully loaded, including TCP, TLS, DNS and TTFB (time to first byte).