How Do You Show Response Headers With cURL?

Quick Answer

Use `curl -i "https://example.com"` to show Hypertext Transfer Protocol (HTTP) response headers beside the response body. Use `curl -I "https://example.com"` only when a HEAD request matches your test. For GET headers without body output, run `curl -sS -D - -o /dev/null "https://example.com"`.

Key Takeaways

• Quick display: `-i` keeps the selected method and places response headers before the body.
• HEAD metadata: `-I` changes the method to HEAD; it is not merely an output switch.
• GET without content: `-D -` writes headers to standard output, while `-o /dev/null` discards the body.
• Separate files: `-D response-headers.txt -o response-body.json` keeps headers and content apart.
• Redirect chains: `-L` follows redirects, and `-D` records every received response block.
• Request direction: Use sending request headers with cURL when the destination needs fields supplied through `-H`.
• Proxy routing:Using cURL with a proxy uses separate proxy settings and, when required, credentials.
• Version awareness: Review cURL fundamentals before relying on newer output variables.

Which cURL Option Should You Use to Show Response Headers?

The correct cURL option depends on whether you need response headers beside content, separately, or from a distinct HEAD request. `-i` is the fastest interactive choice. Scripts usually need `-D` or `--write-out` because these options keep values separable.

The official cURL command-line manual defines each option, its exact request behavior, and its version boundaries. Choose by method and output destination; displayed status and challenge fields can also help diagnose proxy error codes.

`-i`, `-D`, and `-w` affect response output differently. `-v` writes diagnostics to standard error, so shell redirection can separate them. Preserve that separation when another program consumes standard output.

What Should You Check Before Running cURL Response-Header Commands?

Reliable cURL header checks require the native executable, a known shell, an approved destination, and a documented request method. Confirm those inputs before comparing results. Method or shell mistakes can otherwise look like incorrect server behavior.

Complete these checks in order:

1. Confirm the executable: Run `curl --version`, then record the installed version and compiled protocol support.
2. Confirm the destination: Record the complete Uniform Resource Locator (URL), required authentication, and expected redirect behavior.
3. Choose the method: Use GET when real retrieval metadata matters, or HEAD when the endpoint documents equivalent support.
4. Match the shell: Use Bash continuations in Bash, PowerShell continuations in PowerShell, and native quoting for each environment.
5. Protect secrets: Keep tokens, cookies, and proxy passwords out of shared commands, screenshots, and retained diagnostics.

Several response features have minimum versions, although `--include` remains an alias for `--show-headers`. `header_json` arrived in cURL 7.83.0, `%header{name}` in cURL 7.84.0, and `--show-headers` in cURL 8.10.0.

Windows PowerShell 5.1 maps `curl` to `Invoke-WebRequest`, which accepts different parameters. Microsoft's Windows cURL documentation recommends calling `curl.exe` when the native program is required. PowerShell 7 and later do not define that alias by default.

The remaining commands use Bash and zsh syntax unless their code fences say otherwise. Replace every example address with an approved endpoint, and preserve the documented method when comparing routes or configurations.

What Are HTTP Response Headers?

HTTP response headers are named fields describing returned content, caching rules, authentication challenges, redirects, cookies, and server context. They appear before response content. cURL presents response control data as an opening status line, but it is not itself a header field.

Request for Comments (RFC) 9110 defines HTTP fields as case-insensitive names paired with values. `Content-Type` describes the representation format, while `Cache-Control` supplies caching directives. `Location` identifies a redirect target when the response status gives that field redirect semantics.

cURL includes the status line when it displays or dumps a complete response header block. Preserve it because it identifies the block's status and is not a named header when validating field totals.

Header names can use different letter casing without changing their meaning. Duplicate fields require field-specific handling because some fields permit lists, while `Set-Cookie` needs separate lines. A parser should preserve repeated values unless the field definition permits safe combination.

Response headers describe the message received through the chosen route, but cannot prove every intermediary preserved the origin fields. Compare known requests, methods, and routes before attributing a difference to the origin server. Record the route when you must identify which path produced the response.

How Do You Show Response Headers and the Body With cURL?

`-i` shows each received response header before the body while preserving the request method selected by other cURL options. The output begins with a status line and fields. A blank line then separates that header block from the response content.

The long form makes the same request on cURL 8.10.0 or later:

Older builds accept `--include`, which remains an alias for the renamed option. The short `-i` form has wider compatibility; verify the installed version before using the long form in shared scripts.

Combined output is convenient for a person inspecting a small text response. It is unsafe for simple line-based parsing because body bytes can resemble header syntax. Binary content also makes the terminal output difficult to read and may contain control bytes.

Without `-L`, cURL stops after the first redirect response and prints its body when one exists. Adding `-L` prints every followed response header block before the final content. Use `-D` when software must keep those byte streams separate.

When `-o FILE` is present, `-i` writes both header blocks and final content to that file. `-i` does not create a separate header stream, so use `-D` when a parser requires one.

How Do You Show Only HEAD Response Headers With cURL?

`-I` sends the HEAD method, so the server returns metadata without the response content defined for an equivalent GET request. This behavior can reduce transferred bytes. It does not guarantee identical fields because the server can omit values computed while generating GET content.

HEAD suits status, validator, media-type, and redirect checks on endpoints that implement it correctly. Compare HEAD with GET once when exact retrieval metadata affects an operational decision.

Do not replace `-I` with `-X HEAD`. The custom request option changes only the method text, while `-I` also configures cURL's HEAD handling. A copied `-X HEAD` command can therefore produce misleading behavior.

Add `-L` when the objective includes the entire redirect path:

The command sends HEAD along the followed path and shows each returned block. `--max-redirs 5` bounds the chain and fails when the limit is exceeded. The destination can still reject HEAD or return metadata differing from GET.

Use GET with `-D` when testing an Application Programming Interface (API), dynamic page, or endpoint with uncertain HEAD behavior. That method obtains the real retrieval response while allowing cURL to discard its body. Method accuracy matters more than saving a small response body.

How Do You Show GET Response Headers Without the Body?

`-D -` writes received header blocks to standard output, while `-o /dev/null` discards the GET response body on Unix systems. `-sS` removes the progress meter but preserves error messages. The request method remains GET because no method-changing option appears.

This command is usually the best answer when someone wants "headers only" from a real GET. Header output goes to standard output, while transfer error messages remain on standard error for separate capture.

Windows uses the `NUL` device instead of `/dev/null`:

cURL 8.16.0 added `--out-null`, which receives and checks the body without writing its bytes. Older systems still need their platform-specific null destination.

Use separate files when both parts matter:

The header file preserves complete received blocks, including status lines and repeated fields. The body file contains only returned content. Check cURL's exit status before trusting either file as a complete transfer.

HTTP error statuses do not make cURL fail by default. Add `--fail` to reject most statuses at least 400 with error 22. Authentication exchanges can be exceptions, so retain and inspect the final header block during diagnosis.

How Do You Inspect Redirects and Multiple Header Blocks?

`-L` follows redirects, while `-D` records every response header block in the exact chronological order cURL receives it for inspection. A chain can therefore contain several status lines. The final block belongs to the final requested address, not the initial address.

Read each block from its status line through the following blank line. A `Location` field belongs to its block, so do not merge fields from separate responses.

Informational responses, authentication exchanges, and proxy tunnels can create additional blocks. An HTTP proxy can return a CONNECT response before the origin returns its response. Use `--suppress-connect-headers` when `-i` or `-D` should omit that proxy tunnel block.

`--suppress-connect-headers` does not change verbose or trace diagnostics; it only removes displayed CONNECT protocol headers. Keep those headers during proxy diagnosis, then suppress them for origin-focused parsing.

Redirect limits prevent loops and unexpectedly long chains. Validate every final status, effective address, and required field before accepting a result. A completed transfer can still end with an application error response.

Status `304 Not Modified` can appear without a body, but it is not a redirect. Classify blocks by status semantics before deciding which fields to retain.

How Do You Extract One Response Header With cURL?

`--write-out` extracts selected response values after completion, avoiding manual parsing when cURL already exposes the required field. `%header{name}` performs a case-insensitive lookup. Leading and trailing whitespace is removed from the returned field value.

`%header{name}` requires cURL 7.84.0 and reads the most recent server response. After `-L`, the lookup normally uses the final response in the redirect chain; use `-D` to retain every block.

For all final-response fields, request JavaScript Object Notation (JSON) output through `header_json`:

The cURL write-out documentation explains both response-header forms. `header_json` requires cURL 7.83.0 or later. Its lowercase names map to arrays, which preserve several values under one field name.

Windows batch files treat percent signs specially and require doubled percent characters, while PowerShell does not. Keep one reviewed command variant for each shell used by a team.

Check the process exit status alongside any extracted value. An empty result can mean the field was absent, or the transfer failed before receiving it. Record the response code when that distinction affects automation.

Field extraction does not decode a value's field-specific syntax. Parse dates, lists, and cookies with the rules defined for their named fields.

How Do You Troubleshoot Response Headers With cURL?

`-v` shows sent headers, received headers, and connection details, making it suitable for controlled diagnosis rather than routine parsing. Lines beginning with `>` describe sent fields. Lines beginning with `<` describe received fields, while `*` introduces cURL's connection notes.

Verbose diagnostics go to standard error, while ordinary response output uses its configured destination. This separation helps inspection, but verbose text is not a stable response-header format.

• No displayed fields: Run without `-s`, then check name resolution, connection errors, and certificate failures.
• Unexpected metadata: Confirm whether the command used GET or HEAD, then compare the same method on both routes.
• Several status lines: Check redirects, informational responses, authentication exchanges, and proxy CONNECT output before selecting a block.
• Missing extracted value: Confirm the field exists in the final response and that the installed cURL version supports `%header{name}`.
• Proxy rejection: Inspect the status and `Proxy-Authenticate` field, then check credentials without exposing them in logs.

Transport Layer Security (TLS) failures can involve protocol mismatches, unsupported ciphers, client certificates, hostnames, trust chains, or system clocks. Diagnose the reported cause before changing certificate settings or client options. `--insecure` and `--proxy-insecure` disable identity checks for different connections, so reserve them for controlled diagnostics.

Verbose output can contain authorization fields, cookies, proxy credentials, and other private data. Apply the same secure proxy credentials controls in automated delivery systems, and redact secrets before sharing diagnostics.

How Do You Collect cURL Response Headers at Scale?

Header collection at scale needs bounded concurrency, per-host pacing, structured output, response validation, and deliberate retention rules. High concurrency magnifies incorrect methods and parsing errors. Begin with one validated request for each distinct endpoint type.

Use this sequence for a repeatable collection job:

1. Define the record: Store the requested address, effective address, method, status, selected fields, timestamp, and cURL exit code.
2. Validate one transfer: Confirm block boundaries, duplicate-field handling, redirect behavior, and the expected final response.
3. Bound the workload: Set total concurrency, per-host concurrency, request-start rate, connection timeout, and maximum transfer time.
4. Classify failures: Separate connection failures, HTTP errors, missing fields, malformed output, and validation failures before retrying.
5. Retry selectively: Retry transient failures with limits, backoff, and jitter, while respecting `Retry-After` and target-specific limits.
6. Protect retained data: Remove credentials and unnecessary cookies, then restrict access to stored headers and diagnostic logs.

cURL can run several transfers with `--parallel` and bound them through `--parallel-max`. cURL 8.16.0 adds `--parallel-max-host` for per-target connection limits. `--rate` affects serial multi-URL starts and is ignored by parallel mode.

Selected `--write-out` values create cleaner records than full header dumps, which should remain only for audits or protocol diagnosis. Validate repeated fields as arrays instead of overwriting earlier values.

Collect only permitted data from approved endpoints, and follow applicable laws, website terms, and published access limits. Cache stable results when repeated checks add no value. Measure valid records rather than completed commands because a zero cURL exit code can accompany an unwanted HTTP status.

How Does Proxidize Help With cURL Response-Header Checks?

Proxidize adds controlled proxy routing to cURL header checks while cURL still determines methods, output handling, and displayed response fields. The proxy changes the network route and source Internet Protocol (IP) address. It does not change the origin's rules or guarantee a particular response.

Use dashboard-generated credentials through protected environment variables:

`--proxy-user` authenticates to the proxy, while `--user` authenticates to the destination. A `407 Proxy Authentication Required` response belongs to the proxy path; use the HTTP 407 troubleshooting guide when it appears.

When cURL reaches a Hypertext Transfer Protocol Secure (HTTPS) destination through an HTTP proxy, it normally creates a CONNECT tunnel. `--suppress-connect-headers` omits those CONNECT response headers from `-i` or `-D`; remove it when diagnosing the tunnel.

Rotating sessions can assign another exit between independent requests. Sticky sessions aim to retain one exit for related checks, although upstream networks can still change an address. Use sticky routing when comparing responses across a sequence that requires route continuity.

Best For: Residential Proxies fit global checks requiring country, city, or Internet service provider (ISP) targeting.

Best For: Mobile Proxies fit mobile-network checks requiring city or carrier context.

Proxidize supports standard proxy credentials, rotating or sticky sessions, dashboard controls, and API management. The same cURL output commands work after adding the proxy endpoint and proxy authentication.

What Is the Best Way to Show Response Headers With cURL?

The best method matches the intended request and keeps headers separate from any content that another process must handle. Use `-i` interactively, `-D` for retrieval output, and `-I` only for genuine HEAD checks.

• `curl -i URL` shows response headers and content in one stream without changing the selected method.
• `curl -I URL` sends HEAD, so its metadata can differ from a GET response.
• `curl -sS -D - -o /dev/null URL` shows GET headers while discarding body output on Unix systems.
• `-L` follows redirects, while `--max-redirs` bounds the chain and `-D` preserves each received block.
• `%header{name}` extracts one final-response field, while `%{header_json}` returns all final-response fields as JSON.
• `-v` belongs in controlled troubleshooting because its diagnostic output can contain secrets and connection details.
• Proxidize can supply managed proxy routes, while cURL remains responsible for methods, credentials, and response output.