HTTP Header Checker

Inspect response headers, status & redirect chain.

Check the raw HTTP response headers, status code and full redirect chain of any public URL — caching, content type, server, CDN and security headers like HSTS and CSP — with a built-in security-header audit. Requests run through our SSRF-screened server because browsers can't read cross-origin headers. Free to use.

How to use HTTP Header Checker

  1. Enter the URL

    Type any website address into the free online HTTP header checker — with or without https:// — to inspect the response it sends back to browsers.

  2. Check the headers

    Click Check headers and the request runs through our SSRF-screened server, instantly retrieving the raw HTTP headers that CORS normally hides from the browser.

  3. Read the status

    See the HTTP status code and final URL, plus the full redirect chain showing the status code at every hop to debug 301, 302 loops and broken links.

  4. Audit security headers

    Review the built-in audit of HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy to harden your site before launch.

  5. Inspect all headers

    Scan the complete response header table for caching, content type, server and CDN headers, plus any Set-Cookie values the page returns.

  6. Copy the results

    Use Copy all to grab the entire raw header block in one click for bug reports, documentation or comparing headers across environments.

Frequently asked questions

Why do I need a server to read headers?

Browsers block JavaScript from reading the response headers of another website (the CORS policy). So the request is made by our server instead, which can see the full headers, and the result is sent back to you. Every URL is SSRF-screened so it can’t be pointed at internal systems.

What can I use this for?

Debugging redirects and redirect loops, checking caching headers (Cache-Control, ETag, Expires), confirming the right Content-Type, verifying CDN and compression headers, and auditing security headers like HSTS, CSP and X-Frame-Options.

What do the security-header checks mean?

They show whether a page sends six widely-recommended protection headers. Green means present; amber means missing. Missing headers aren’t necessarily a problem, but adding them (especially HSTS, CSP and X-Content-Type-Options) hardens a site against common attacks.

Does it follow redirects?

Yes. It follows up to 10 redirects, re-checking each hop for safety, and shows you the status code and URL of every step plus the final destination.

How do I check HTTP response headers online for free?

Just paste a URL into this free online HTTP header checker and click Check headers. It instantly returns the full response header block, status code and redirect chain for any public website — no signup, no extension and no command line needed.

How can I check security headers like HSTS and CSP for a website?

Enter the page URL and the security audit section flags whether HSTS, Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are present or missing — a quick way to test a site’s HTTP security headers before launch.

What does an HTTP status code like 301, 302 or 404 mean here?

The status badge shows the server’s response: 200 means OK, 301/302 are redirects (shown hop-by-hop in the redirect chain), and 404 means not found. Use this HTTP header checker to debug redirect loops, broken links and incorrect status codes.

How do I see the response headers of a URL without curl?

Paste the URL here and click Check headers — the tool makes the request server-side (bypassing browser CORS) and returns the full response header block, status code and redirect chain in your browser, so you get the same info as curl -I with no command line needed.

What are the most important security headers to add?

The high-impact ones are Strict-Transport-Security (HSTS) to force HTTPS, Content-Security-Policy (CSP) to limit what loads, X-Content-Type-Options to stop MIME sniffing, and X-Frame-Options to block clickjacking. The security audit here flags which of the six recommended headers your page is missing.

Related tools — Site diagnostics