URL, HTTP & curl

Get a Response Header: Capture the Actual HTTP Exchange

Capture response headers with curl, separate redirect responses from the final result, and interpret missing fields without confusing HEAD and GET behavior.

By Uddhav Gopani, FounderPublished 27 September 2026Updated 29 September 2026

Choose the response you actually need to inspect

To get a response header, first decide which HTTP request you are investigating. The same URL can return different headers for a GET, a HEAD request, an authenticated session or a redirected destination. A header copied from a different exchange may be accurate but irrelevant to the failing case.

For a reproducible investigation, record the method, URL, time and relevant non-secret request options. Keep the response status alongside the header block. A Content-Type returned by an error page should not be mistaken for the content type of the successful API representation.

Save headers without mixing them into the body

curl --silent --show-error --dump-header response-headers.txt \
  --output response-body.txt https://example.com/notes/7

This command illustrates an ordinary GET. The example.com address is a placeholder; use an endpoint you are authorized to inspect. The header dump and body go to different files, making it easier to compare the two without accidentally treating an HTTP status line as part of the payload.

In the curl dump-header documentation, the option writes received protocol headers to a file. Check the command's exit status as well. A saved file by itself does not prove that DNS, TLS, transfer completion or the application response met your expectation.

Use HEAD only when its semantics fit the investigation

The curl --head option asks for a HEAD response. It is useful when you want headers without downloading the representation body, but it changes the request method. An endpoint can reject HEAD or route it differently from the GET call you are trying to debug.

If the problem appears only on GET, reproduce GET and direct its body to an appropriate destination. Do not silently replace the request with HEAD and conclude that the original behavior has been verified. For a large download, consider a documented bounded endpoint or another controlled fixture.

Keep redirect hops separate

A redirect response can include Location and its own cache policy. Following that redirect produces another response with another header block. Label the blocks by URL and status rather than joining all similarly named fields into one imagined response.

For example, an initial 301 can direct a request to an HTTPS host, while the final 200 supplies Content-Type: application/json. The 301's header set describes the redirect response, not the JSON resource. A security or caching review should identify which boundary each observation belongs to.

Following an unfamiliar destination also needs a credential policy. Do not manually forward an Authorization value to a different host just because the first response includes its URL. Preserve the client library's safeguards and inspect the intended destination before changing them.

Preserve values before simplifying them

Header names are case-insensitive, but values follow each field's own grammar. A date contains commas and colons, and a URL can contain additional colons. Avoid splitting every line at every colon or treating a comma as a universal list separator.

Duplicate fields also require field-specific handling. Preserve the raw capture while producing a convenient summary. A summary that stores one value per name can lose information, particularly when multiple response blocks or repeated fields were present.

The HTTP headers reference helps identify a field's role. Its presence is not automatically proof of a correctly configured policy; the value, response context and browser or intermediary behavior matter.

Use a pasted-header check for a limited follow-up

The Response Header Checker analyzes pasted text. It does not retrieve the live URL, reproduce your cookies or certify the site's security. Supply one redacted response block at a time, then compare its observations with the field's actual meaning.

For a useful regression fixture, capture two controlled responses with different Content-Type and request-identifier values. Confirm that your extraction distinguishes them and that an absent field remains absent. Keep credentials and personal data out of stored examples, and retain the original raw block when a summary is disputed.