HTTP Header Checker

How to use the HTTP Header Checker#

1. Paste any URL, including https://.
2. Run the check. The tool makes a real request and follows every redirect to the final page.
3. Read the summary first: the status code, how many redirects it took, and the response time.
4. Check the security headers section for quick wins, then the caching and compression notes.
5. The full, raw header list is at the bottom if you need to confirm an exact value.

Understanding your results#

Status code. 200 means the page loaded. 301/302 are redirects. 404 is missing, 403 is blocked, 5xx is a server error. We show the real code even when it is an error, because the headers are still useful for debugging.

Redirect chain. Every hop between the URL you entered and the final page, with each hop's status. Long chains slow crawlers and visitors; an http:// → https:// upgrade should be a single 301.

Security headers. These are optional but each one closes a common attack, so a missing header is hardening you can add, not a bug:

• HSTS (Strict-Transport-Security) forces browsers to use HTTPS.
• Content-Security-Policy limits where scripts, styles and frames may load from — the strongest defence against cross-site scripting.
• X-Content-Type-Options: nosniff stops browsers guessing a file's type.
• Clickjacking protection (X-Frame-Options or a CSP frame-ancestors rule) stops other sites framing your pages.
• Referrer-Policy controls how much of your URL leaks when visitors click away.
• Permissions-Policy restricts features like camera, microphone and location.

Caching. Cache-Control, Expires, ETag and Last-Modified decide how long browsers and CDNs keep a copy. Good caching cuts repeat load times and server work.

Compression. A Content-Encoding of gzip or br (Brotli) means text responses are compressed, which makes them much smaller and faster. No header means the response is sent uncompressed.

Server & technology. Headers like Server, X-Powered-By and CF-Ray hint at the stack and CDN behind the site.

How this tool works#

The tool sends a real HTTP request from our server, follows redirects up to a safe limit, and reports the headers of the final response along with the whole chain. It reads only the headers and a small part of the body, so it is fast and light.

Because the request comes from a server, not your browser, a few sites behind bot protection may return a 403 or a challenge page. That is the site's own policy, and the status and headers it returns are still shown.

To dig into a specific redirect, use the Redirect Checker. To check the certificate behind the HTTPS, use the SSL Checker.

Tips#

• Send visitors straight to the final URL. Every extra redirect adds a round trip for browsers and crawlers.
• Turn on gzip or Brotli for HTML, CSS and JavaScript if the Content-Encoding header is missing.
• Add Strict-Transport-Security, X-Content-Type-Options: nosniff and clickjacking protection — they are quick to set and widely recommended.
• Avoid Set-Cookie on pages you want a CDN to cache; a cookie often makes the response uncacheable.
• Compare a cached and an uncached hit (look at Age or CF-Cache-Status) to confirm your CDN is actually serving from cache.

Frequently asked questions#

What are HTTP headers?#

HTTP headers are extra lines a server sends with every response, describing the content and how browsers should treat it — the status, the content type, caching rules, security policies and more. They are invisible on the page but control a lot of its behaviour.

Why does the checker show a 403 or a challenge page?#

Some sites block automated requests with a firewall or bot protection. The request from our server looks automated, so it can be refused even though the page opens fine in your browser. The status and headers returned are still the site's real response.

How do I add security headers?#

Where you set them depends on your stack: your web server config (Nginx, Apache), a CDN like Cloudflare, or your application framework. Start with Strict-Transport-Security, X-Content-Type-Options: nosniff and either X-Frame-Options or a Content-Security-Policy.

What is the difference between this and the SSL Checker?#

This tool reads the HTTP response and its headers. The SSL Checker inspects the TLS certificate itself — who issued it, when it expires and which hostnames it covers.

Does checking headers change anything on my site?#

No. The tool only reads the response. It makes ordinary GET requests, exactly like a browser or crawler visiting the page.