Check a website's HTTP headers

Enter a URL to see what its server returns, where it redirects and which security headers it is missing.

How to check a website's HTTP headers

Type or paste the full URL, including its path if you want to check a specific page.
Click «Check»: we make the request from our server and follow redirects, as a browser would.
Review the redirect chain, the missing security headers and the full list from the final response.

What HTTP headers are

Every time you request a page, the server replies with a status code (200, 301, 404…) and a list of headers before the content. Headers are not visible on the page, but they decide a lot: the content type, how long to cache it, cookies, compression, redirects and the security rules the browser must apply.

Checking them helps you debug redirects, verify a CDN's caching, confirm that a site enforces HTTPS or audit its security.

The most common status codes

200 OK: the page exists and is delivered.
301 Moved Permanently: permanent redirect. The right choice for SEO when a URL changes, because it passes on its ranking.
302 Found and 307 Temporary Redirect: temporary redirects. Search engines keep the original URL.
308 Permanent Redirect: like 301, but keeping the method (POST stays POST).
403 Forbidden: the server refuses to serve it (sometimes because it blocks bots).
404 Not Found: it does not exist.
500 and 503: server error or service unavailable.

A good setup does a single redirect from http://example.com to https://www.example.com (or the other way round), not a chain of several.

Security headers every website should have

Strict-Transport-Security (HSTS): enforces HTTPS for the time given. Typical value: max-age=31536000; includeSubDomains.
Content-Security-Policy: a list of allowed origins for scripts and resources. The most powerful and the trickiest to configure; start with Content-Security-Policy-Report-Only.
X-Content-Type-Options: nosniff.
X-Frame-Options: DENY or SAMEORIGIN (or frame-ancestors in the CSP).
Referrer-Policy: strict-origin-when-cross-origin is a good balance.
Permissions-Policy: turn off what you do not use, for example camera=(), microphone=(), geolocation=().

You should also hide Server and X-Powered-By, which only give hints to an attacker.

How we make the request

We request the page from our server with a normal GET request, read only the headers (we do not download the content) and follow up to five redirects. For security, we only query public addresses on ports 80, 443, 8080 and 8443, never an internal network.

Bear in mind that some servers answer differently depending on who asks: a CDN may return another cache depending on the country, and some sites block automated requests with a 403. If something looks odd, compare it with the Network tab of your browser's developer tools.

Frequently asked questions

How do I check whether a redirect is 301 or 302?

Enter the source URL: the responses table shows the code of each hop. For SEO, a permanent URL change should be a 301 (or 308).

Why do I get 403 when the site works in my browser?

Some sites and CDNs block requests that do not come from a real browser, or those from data centers. It does not mean the site is down.

How do I add security headers to my website?

In the server configuration (add_header in Nginx, Header set in Apache), in your CDN (Cloudflare, for example, lets you add them with rules) or from the application itself. Then check them again here.

Is the page content downloaded?

No. We only read the status line and the headers, then close the connection. We store neither the URL nor the response.