Everything About HTTP Header Checking
This free HTTP header checker shows exactly what response headers a website sends, right in your browser. Instead of running curl -I in a terminal or digging through the devtools network tab, just enter a URL to see the status code, the complete response headers, and any redirect — all on one screen. It is especially handy right after a deploy, when you want to confirm Cache-Control or Content-Type is going out as intended.
The headline feature is the automatic security header grade. Five headers are scored with a clear pass/fail: HSTS (forces HTTPS), CSP (XSS defense), X-Frame-Options (clickjacking defense), X-Content-Type-Options (MIME sniffing prevention), and Referrer-Policy (referrer leakage control). For each configured header the actual value is shown too. If you run a website, getting these five right establishes the browser-level defense baseline against the most common attacks.
Redirect handling is built for real-world debugging. Rather than silently following 3xx responses to the final page, the tool shows each hop and lets you follow them manually, one at a time, up to 5 hops — inspecting the status code and headers at every step. That makes it easy to verify your http→https 301 is correct, count how many hops your www redirect takes, and catch stray 302s that can hurt SEO.
Requests are proxied through a server (Cloudflare Pages Functions), so any public site can be checked without CORS restrictions. For SSRF protection, private IP ranges, internal hostnames, and non-standard ports are blocked, and the server returns only headers — response bodies are never read or exposed. Pair it with the DNS lookup tool for DNS records and the domain info checker for expiry dates to complete a full website health check in one place.