See the status, response headers and redirect chain of any URL, with security checks
Checked from our server in India. Only the address you type is sent to us; nothing else leaves your device. Updated on 24 Oct 2026.An HTTP headers checker requests a web address and shows what the server sends back before the page itself. This one requests from our server in India, follows up to 5 redirects, lists every status code and header, and checks 6 security headers, including HSTS and Content-Security-Policy, each with a plain verdict.
Type the web address, and keep GET or switch to HEAD.
Press Check headers. Our server requests it and follows up to 5 redirects.
Read each response and the security verdicts, then copy the headers.
Every web response starts with a status code and a list of headers: how long the page may be cached, which cookies are set, where a redirect points, which software served it and what the browser is allowed to do with the page. The HTTP Headers Checker shows all of that for any public address. Our server makes the request, follows up to 5 redirects one by one, and lists each step with its status, its HTTP version, its time and every header, exactly as sent and in order.
For the final response, six security headers get a verdict. Strict-Transport-Security should be present on HTTPS with a max-age of at least six months. Content-Security-Policy should exist and should not allow inline scripts without a nonce or hash. X-Frame-Options or the CSP frame-ancestors rule should stop other sites framing the page. X-Content-Type-Options should be nosniff. Referrer-Policy and Permissions-Policy are noted. Server and X-Powered-By headers that reveal software versions are pointed out, and a plain-http address is checked for a redirect to https.
The request is made without cookies, without your browser's headers, and with a user agent that names this site. Sites that vary by country, device or login can answer our server differently from the way they answer you.
Only http and https addresses on the public internet are checked; private networks, localhost and this site are refused, and every redirect is checked again before it is followed. At most 64 KB of the page body is read and then thrown away, so the tool never downloads files. The address's query string is not kept in our log or shown back in the step list. Each visitor can run 10 checks a minute.
Type the starting address and press Check headers. Each redirect appears as its own step with its status code, 301 or 308 for permanent and 302, 303 or 307 for temporary, and its Location header. Up to 5 redirects are followed, and a loop is detected and reported.
At least Strict-Transport-Security on HTTPS, a Content-Security-Policy, X-Content-Type-Options set to nosniff, and either X-Frame-Options or a CSP frame-ancestors rule. Referrer-Policy and Permissions-Policy are useful extras. The checker marks each one pass, note or fail and says what to add.
GET asks for the page itself, and HEAD asks for the headers only. Most servers send the same headers for both, but some answer HEAD differently or not at all. GET is the default because it matches what a browser does; at most 64 KB of the body is read and discarded.
Our server sends no cookies and none of your browser's headers, and requests from India. Sites that vary by login, language, device or country, or that sit behind a bot filter, can therefore answer differently. Headers added by browser extensions or a local proxy also never appear here.
Only the host name is logged, with the result and a hashed, daily-rotated version of your IP address, for 30 days to prevent abuse. The path's query string is never written to our log, and the step list shown on the page replaces it with a question mark and an ellipsis.
Every redirect target is checked again before our server follows it. A redirect to a private network address, a cloud metadata address, localhost, this site, or a scheme other than http and https is refused, and the step list says why it stopped.
Still stuck? Ask about HTTP Headers Checker and anybody who knows can answer. No account needed.
Also works as: HTTP Header Checker.
Open it set for: Security Headers Checker.
Same job, other tools: NS Lookup – Find the name servers a domain is delegated to, and how long resolvers cache them.
On the related tools: IP to ASN Lookup – Map an IP address to the ASN that announces it, with the BGP prefix.