How to use
01
Paste the URL or a list
Enter a full address like https://example.com/page; https:// is added if missing. For many pages, switch to Bulk and paste up to 20 URLs, one per line.
02
Press Check
Our server sends a HEAD request and follows redirects. You get the status, response time, server or CDN, final URL, redirect chain, security grade with its checklist, and a caching verdict.
03
Review and copy headers
Filter the header list, read the meaning under each name, and copy a single value or all of them. Download the set as TXT or JSON, or the bulk table as CSV.
Why HTTP Header Checker
- Every response header from any URL, with status code, final URL, redirect hops and response time.
- A security grade from A+ to F, based on six key headers plus HSTS, CSP, cookie and version-leak checks.
- Plain-English meaning for over 40 common headers, a caching verdict and CDN detection.
- Bulk mode checks up to 20 URLs at once. Copy or download the results as text, JSON or CSV.
Common response headers and what they control
A typical response carries 10 to 30 headers. These are the ones most worth reading when you debug caching, redirects, indexing or security. Header names are case-insensitive, which is why the list shows them in lower case.
| Header | What it controls | Example value |
|---|---|---|
| content-type | The format and character set of the response | text/html; charset=utf-8 |
| cache-control | How long browsers and CDNs may reuse the response | public, max-age=3600 |
| location | Where a 3xx redirect sends the visitor | https://example.com/new-page |
| x-robots-tag | Indexing rules for search engines, set in the header | noindex, nofollow |
| strict-transport-security | Forces HTTPS on future visits | max-age=31536000; includeSubDomains |
| content-security-policy | Which sources scripts, styles and frames may load from | default-src 'self' |
| access-control-allow-origin | Which other sites may read the response (CORS) | * |
| server | The web server or CDN that answered | nginx or cloudflare |
| set-cookie | Cookies the server asks the browser to store | session=abc; Secure; HttpOnly |
Caching headers for SEO and speed
Caching decides whether a repeat visitor or a CDN downloads a file again or reuses the copy it has. Good caching makes pages faster, which helps visitors and Core Web Vitals. Bad caching either wastes bandwidth or keeps serving old content after you publish a change.
Check these headers on your HTML pages and on a CSS or image file, because they usually need different rules.
- Cache-Control: the main rule. Long max-age values suit versioned CSS, JS and images; HTML usually needs a short max-age or no-cache.
- ETag and Last-Modified: let the browser ask whether a file changed and get a small 304 Not Modified reply if it did not.
- Age: how many seconds a CDN or proxy has held its copy. A large Age on HTML can explain why an update is not showing.
- Vary: tells caches to store separate copies per request header, such as Accept-Encoding. Vary on User-Agent can reduce CDN hit rates.
- Expires: an older way to set a cache date. Cache-Control max-age takes priority when both are present.
Common questions
Why does the header checker use a HEAD request instead of GET?
HEAD asks for the same headers as GET but skips the page body, so checks are fast and light. A few servers reject HEAD with a 405 status. The tool tells you when that happens, because the headers you see are then from the rejection, not the normal page.
What does the Final URL card in the header results mean?
It is the address the request ended up at after following every redirect. If it differs from what you typed, the redirect chain above the headers shows each step and its status code.
How do I see each redirect in a chain with the header checker?
When the URL redirects, a Redirect chain list appears under the summary cards. Each row shows the URL and the status code it returned, such as 301 or 302, ending with the final page. Up to 10 hops are followed.
Which security headers should appear when I check a production site?
The checklist covers six: Strict-Transport-Security on HTTPS sites, Content-Security-Policy, X-Frame-Options or a CSP frame-ancestors rule, X-Content-Type-Options set to nosniff, Referrer-Policy and Permissions-Policy. A missing header is not a breach in itself, but each one closes a known class of attack. The tool also flags some weak values, such as a short HSTS max-age, 'unsafe-inline' in CSP or an unsupported X-Frame-Options value.
How do I read cache-control values in the response headers?
max-age is how many seconds a browser may reuse the response. no-cache means it must check with the server before reusing it, and no-store means it must not keep a copy at all. public lets shared caches such as CDNs store it, while private limits storage to the visitor's browser.
How can I find an X-Robots-Tag noindex in the HTTP headers?
Look for an x-robots-tag row in the header list. A value containing noindex tells search engines not to index the URL, even when the page's HTML has no robots meta tag. It is a common cause of pages dropping out of Google after a server or CDN change.
Can I check headers on a URL that requires login?
No. The request comes from our server without your cookies or session, so you see what an anonymous visitor gets, which is often a redirect to the login page. Use your browser's developer tools for pages behind a login.
Can the HTTP header checker send a Googlebot or mobile user agent?
No. Requests use our own bot user agent and the HEAD method, so a server that varies its response by user agent may send slightly different headers to Googlebot or to a phone. For most headers, such as caching and security, the answer is the same.
Why is the response time in the header check lower than my page load time?
The number covers one HEAD request from our server to yours, including redirects. A real page load also downloads the HTML, images, scripts and fonts, then renders them. Treat the figure as a rough server response time, not a page speed score.
How is the security header grade worked out?
A site with all six headers starts at A, and each missing one drops a letter, down to F. A+ needs a one-year HSTS policy with includeSubDomains and no warnings. A page served over plain HTTP is capped at C. The grade is a quick guide in the spirit of well-known header scanners, not an audit.