HTTP Header Checker
Fetch and display the HTTP response headers of a URL.
HTTP Header Checker shows, in real time, the exact response status code and headers a server returns for a given URL. Without opening browser dev tools, you can review security headers (HSTS, CSP, X-Frame-Options), caching policy (Cache-Control, ETag), the server software, and content type at a glance.
Requests go through a safe server-side proxy, so you see every header verbatim without CORS restrictions. When redirects occur, each hop is traced and the final destination URL and status code are shown together. Just enter a URL.
Key response headers at a glance
- Content-Type: the body's MIME type and character encoding (charset)
- Cache-Control / ETag / Last-Modified: caching and revalidation policy
- Strict-Transport-Security: whether HTTPS is enforced (HSTS)
- Content-Security-Policy: restrictions on script and resource origins
- X-Frame-Options: framing restrictions to prevent clickjacking
- Server: server software (be cautious about exposing it)
Reading status codes and redirects
2xx means success, 3xx a redirect, 4xx a client error, and 5xx a server error. This tool follows redirects such as 301 and 302 and records each hop, so you can confirm that http to https enforcement or www normalization works as intended. If the final URL differs from your input, a redirect occurred.
How to use it
It is great for quickly verifying after a deploy that security headers are not missing, that your CDN and cache policy is applied, and that there are no broken redirect loops. Only headers are fetched, not the body, so it stays light and fast. To grade just the security headers, use the security headers checker; to trace a redirect chain hop by hop, use the HTTP status & redirect checker.