Example input
Enter a domain or complete URL.
https://example.com
HTTP protocol tools
HTTP Header Checker
Inspect the live HTTP response headers of any public website. Check status codes, redirects, cache policy, cookies, server disclosure, HSTS, CSP, X-Frame-Options, content type, and other browser-facing response details.
Header tableView ordered response headers exactly as the website returns them.
Redirect pathFollow common redirects and see the final URL.
Security reviewSpot HSTS, CSP, referrer policy, frame protection, and missing headers.
HTTP Header Checker: Working tool
Enter a public website URL or domain. The checker uses the backend to fetch headers so CORS restrictions do not hide the response.
Response summary
Status, final URL, timing, protocol, and security score.
Security and policy signals
Common security, server, cookie, cache, and content headers.
Redirect path
Redirects followed before the final response was inspected.
HTTP response headers
Header names and values returned by the final response.
| Header | Value |
|---|
HTTP Header Checker: Short intro
HTTP headers are small pieces of metadata sent with every web response. They tell browsers and clients how to cache a page, whether a website enforces HTTPS, which content type is returned, whether framing is allowed, what cookies are set, and which security policies are active.
This checker is useful when a website behaves differently across browsers, CDNs, reverse proxies, load balancers, WAFs, or application servers.
HTTP Header Checker: Example input/output
Example output
The table can show headers like:
content-type: text/html; charset=UTF-8
cache-control: max-age=604800
server: ECS
Security output
The checker highlights whether headers such as HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy are present.
HTTP Header Checker: Common errors
- Invalid URL: enter a public domain such as
example.comor a complete URL such ashttps://example.com/path. - Timeout: the website did not respond within the tool limit or blocked automated requests.
- Too many redirects: the website redirected more than the allowed chain length.
- Private address blocked: internal, loopback, local, multicast, and reserved IP ranges are not accepted.
- HEAD blocked: some servers reject HEAD requests. Switch to GET if the site does not support HEAD.
HTTP Header Checker: Use cases
Security header audit
Quickly confirm whether HSTS, CSP, frame protection, MIME sniffing protection, and referrer controls are visible.
CDN and proxy checks
Compare origin, CDN, WAF, or load balancer behavior by inspecting headers on the public URL users visit.
Cache troubleshooting
Review Cache-Control, Expires, ETag, Last-Modified, Age, and CDN-specific headers when content does not update as expected.
Redirect validation
Confirm whether HTTP redirects to HTTPS, whether www and apex names resolve correctly, and where the final response lands.
Cookie visibility
Check whether Set-Cookie is present and then review Secure, HttpOnly, SameSite, and domain settings in your browser or application logs.
Incident triage
Use status code, server, content type, and policy headers as a fast first look during outage or change validation.
HTTP Header Checker: FAQ
Does this show request headers?
No. It shows response headers returned by the website after the checker sends a simple HEAD or GET request.
Why do results differ from my browser?
Your browser may include cookies, authentication, geography, device hints, or cache state. This checker sends a clean public request from the server.
Should every site have all security headers?
No single list fits every site, but HSTS, CSP, X-Content-Type-Options, Referrer-Policy, and frame controls are common production review items.
Can it inspect intranet URLs?
No. The tool blocks private and local address ranges for safety. Use local command-line tools for internal systems.
What is better, HEAD or GET?
HEAD is lighter because it asks for headers only. GET is useful when a server does not support HEAD or returns different behavior.
Does this replace a security scan?
No. It is a quick header inspection tool. Use it with application tests, vulnerability scans, configuration review, and browser validation.
HTTP Header Checker: Related tools
- Security Headers Checker for a focused scorecard covering HSTS, CSP, clickjacking, MIME sniffing, referrer, permissions, and cross-origin policy headers.
- SSL Checker for certificate validity, issuer, expiry, chain, and TLS details.
- Certificate Checker for decoding pasted PEM certificates.
- Certificate Chain Composer for fetching missing intermediate certificates.
- DNS Lookup for checking A, AAAA, MX, TXT, NS, SOA, and CNAME records.
- IP Location Finder for public IP, ASN, ISP, organization, and approximate location checks.