Skip to content

HTTP headers checker

Fetch response headers for any public URL. See a security summary for HSTS, CSP, and other key headers - plus all raw headers grouped by category.

How it works

Three steps to your result.

  1. Enter a URL

    Paste a full URL or bare domain. We normalize it to https if no protocol is given.

  2. We fetch the headers

    Our server sends a HEAD request (or GET if HEAD is rejected) and reads all response headers.

  3. Review the results

    See all headers grouped by category, and a security summary showing which key headers are present or missing.

Frequently asked questions

Quick answers about this tool.

Why HEAD and not GET?
HEAD is faster and downloads no body. We fall back to GET if the server rejects HEAD.
What does the security score mean?
It counts how many of 5 recommended security headers are present: HSTS, X-Frame-Options, CSP, X-Content-Type-Options, Referrer-Policy.
Are results cached?
Yes, results are cached for 2 minutes per URL.
Can I check a staging URL?
Only public hostnames are allowed. Localhost and private IPs are blocked.

Good to know

Context and tips to get more out of this tool.

What a header checker shows

Every web response starts with a status code and a set of headers the page itself never shows. This checker requests the URL from our servers, follows up to five redirects, and shows the final URL, the status code, and every response header: caching, content type, server, cookies, and security headers.

The five security headers we score

Strict-Transport-Security forces HTTPS. Content-Security-Policy limits where scripts and other resources can load from. X-Frame-Options stops other sites from framing your pages. X-Content-Type-Options stops browsers from guessing file types. Referrer-Policy controls how much of your URL is passed to other sites. The score counts how many of the five are present. It does not judge whether each value is strict enough.

Use it for SEO checks too

Headers explain a lot of indexing puzzles. An X-Robots-Tag: noindex header hides a page from Google even when the HTML looks fine. A redirect chain shows up as a different final URL. A Cache-Control header that is too long explains why an old version keeps appearing.

See the real conversations behind this check

The moment you know your site, name, or profile is healthy, the next step is demand: find the people already discussing the problem you solve, ranked by buying intent.

Book a demo

Cancel anytime