Inspect a web response without changing the system

What you will learn

This lab uses your own private TLB website. It sends read-only HTTP requests and prints what the server returns. It does not install software, change registry values, edit network settings or require administrative rights. The example is intentionally small so that each output can be explained.

You need Python 3 and the local site running. A command that succeeds here proves something about this local service at the time of the test. It does not measure the public domain or every device on the network.

Run the inspection

Save the following as inspect_response.py in a temporary working folder and run it with Python. It asks for the homepage, prints the response status and shows a small selection of headers. The timeout keeps a non-responsive target from waiting indefinitely.

from urllib.request import urlopen
from urllib.error import HTTPError, URLError

url = 'http://127.0.0.1:3000/'
try:
    with urlopen(url, timeout=5) as response:
        print('Status:', response.status)
        for name in ('Content-Type', 'Cache-Control', 'X-Content-Type-Options'):
            print(f'{name}: {response.headers.get(name, "not present")}')
except HTTPError as error:
    print('HTTP error:', error.code)
except URLError as error:
    print('Connection failed:', error.reason)

Interpret the response

A 200 status means this request succeeded according to the server. Content-Type describes the representation returned. The MIME-sniffing protection header asks the browser to respect the declared type rather than infer a different one. The cache policy controls whether and how a response may be reused.

Do not turn a header checklist into a security certificate. These fields tell you about specific controls, not whether an application is free of vulnerabilities. Likewise, a short response time on localhost is not a measurement of an internet user’s experience.

Compare a missing resource

Change only the URL path to /this-page-does-not-exist/. Keep the address and port the same. The expected result is a handled 404. This distinguishes an application that responded with “not found” from a connection that could not reach the service at all.

Now inspect /healthz. That endpoint is intended for monitoring and returns a machine-readable status. Its success is useful, but an operational acceptance test still needs to open real article pages and complete reader journeys.

Keep useful evidence

Record the time, URL, output and version of the application tested. Avoid capturing authentication cookies or private tokens in shared evidence. Preserve both successful and unsuccessful cases.

To clean up this exercise, delete the single script you created. There are no system settings to undo. The broader lesson is that a safe diagnostic should have a clear purpose, bounded behaviour and an explanation of what its result does—and does not—prove.