HTTP Header Checker — Inspect Response Headers & Security
See any site's response headers, redirect chain and security header grade.
🔗 This tool runs on our server, because your browser cannot read another site's response headers directly. We fetch the URL, read the headers and discard the page — nothing is stored beyond a 5-minute cache. Limited to 20 checks per minute.
Redirect chain
Security headers
All response headers
Enter any URL to see the HTTP headers its server returns, the full redirect chain, and a grade for the six security headers that matter most.
This is one of the few tools here that genuinely needs a server: browser security rules stop JavaScript reading another site's response headers, so the request is made from ours.
How to use HTTP Header Checker
- Enter a URL. You can leave off
https://. - Click Check headers.
- Read the security grade and the full header list below it.
The security headers we grade
Strict-Transport-Security (HSTS) tells browsers to use HTTPS for all future visits, closing the window where a first plain-HTTP request can be intercepted.
Content-Security-Policy controls which sources scripts, styles and frames may load from. It is the single strongest defence against cross-site scripting, and also the hardest to deploy without breaking a site.
X-Content-Type-Options: nosniff stops browsers second-guessing a file's declared type — without it, a user-uploaded file can be coaxed into executing as script.
X-Frame-Options prevents your page being embedded in a hostile frame, the basis of clickjacking. Modern sites can use CSP's frame-ancestors instead.
Referrer-Policy limits how much of your URL is leaked to other sites in the Referer header — important when URLs contain tokens or identifiers.
Permissions-Policy switches off browser features the page does not need, like camera, microphone and geolocation.
Why the redirect chain matters
Every redirect costs a round trip. A chain like http://example.com → https://example.com → https://www.example.com makes every visitor wait through three requests before a byte of content arrives. Redirect directly to the final destination where you can.
Chains also dilute SEO signals and can mask problems — a page that looks fine may be arriving via a 302 (temporary) where a 301 (permanent) was intended, which changes how search engines treat it.
About this tool and your privacy
We fetch the URL from our server, read the headers and discard the page body. Results are cached for five minutes so repeated checks of the same site do not generate repeated traffic. Requests are limited to 20 per minute per visitor.
Only public addresses can be checked. URLs that resolve to private or internal networks are rejected, and redirects are re-validated at every hop — a deliberate safeguard, since a URL-fetching service that follows redirects blindly can be tricked into reaching servers it should not.
Frequently asked questions
Why does this tool need a server when others do not?
Browser security (CORS) stops JavaScript reading another origin's response headers — that restriction exists to protect you. So the request is made from our server instead. It is one of only a handful of tools here that works this way.
Do you store the URLs I check?
Results are cached for five minutes so repeated checks of the same site do not generate repeated traffic, and that cache is keyed by a hash of the URL. We fetch the page, read the headers and discard the body.
Can I check a site on my local network?
No. URLs resolving to private or internal addresses are rejected, and every redirect hop is re-validated. A public URL-fetching service that followed redirects blindly could be tricked into reaching internal servers, so the restriction is deliberate.
What is a good security header grade?
A or B. Missing HSTS and Content-Security-Policy are the two that matter most — CSP is the strongest defence against cross-site scripting, and HSTS closes the plain-HTTP window before a redirect to HTTPS.
Is there a usage limit?
Twenty checks per minute. This is the only kind of tool on the site that makes outbound requests from our server, so it is the only one that needs a limit.