HTTP Headers Checker
View all HTTP response headers for any URL and check for missing security headers like HSTS, CSP, and X-Frame-Options.
Did this tool work for you?
How to use this calculator
- 1
Enter the full URL including https:// (or just the domain — https:// will be added).
- 2
Click "Check Now" to fetch the HTTP response headers.
- 3
Results show all response headers, status code, and any missing security headers.
- 4
Security headers like HSTS and CSP protect users from common web vulnerabilities.
Frequently asked questions
How does the tool fetch the headers?
Our server sends a HEAD request to the URL, following redirects, with a 10-second timeout. Only if that request throws an error (not if the server answers 405 or 403) does it retry with GET. The headers shown therefore belong to the final URL after redirects, which the tool prints as Final URL. Response Time is how long that request took from our server, not from your location.
Which security headers does it check?
Six: strict-transport-security, content-security-policy, x-frame-options, x-content-type-options, referrer-policy and permissions-policy. Any that are absent are listed under Missing Security Headers as Not set. It checks presence only. It does not read the values, so a weak Content-Security-Policy or an HSTS max-age of a few seconds is not flagged.
The tool says x-frame-options is missing, but I use frame-ancestors. Is that a problem?
No. The frame-ancestors directive of Content-Security-Policy is the modern way to control embedding and takes precedence in browsers that support it, so the checker does not list x-frame-options as missing when the policy contains frame-ancestors. The Response Headers table always shows exactly what the server sent. Many sites send both for older clients.
Why do I see headers I did not set, such as server or via?
Hosts, CDNs and proxies add their own. A CDN may add cache status, a request ID or its own server name, and your origin’s headers may be replaced or removed on the way. You are seeing what the public edge returns, which is also what visitors’ browsers receive.
Why are the headers different from my browser’s developer tools?
Servers often vary a response by request method, user agent, cookies, language or country. This tool sends an anonymous request without cookies, using a HEAD method, from our server’s network. A page behind a login, a bot-protection challenge or a country-specific rule can return different headers, or a 403, to this request than to your browser.
Does it show cookies, TLS version or HTML content?
It lists every header the response carries, including any Set-Cookie lines, but it does not analyse cookie flags such as Secure, HttpOnly or SameSite. It does not report the TLS version or certificate (use the SSL checker for the certificate), and a HEAD response has no body, so the page content is not examined.
What does a green Status Code mean?
The status is shown as good when the final response is in the 200–299 range and as a warning otherwise, including 3xx codes that were not followed to a final page, 404 and 5xx errors. It does not mean the page is secure or well configured.
Can it read headers from a local or internal site?
No. The request is made by our server, which is only allowed to contact public internet hosts. Addresses like localhost, 192.168.x.x and 10.x.x.x are rejected, and a redirect from a public site into such an address is refused as well. For a local project, use your browser’s network panel or curl -I against it.
Reading HTTP response headers and the security headers this tool flags
What you get back
The result has up to three blocks. The first gives the final status code, the request time in milliseconds and the final URL after redirects. The second is a table of every response header, sorted alphabetically by name. The third appears only when at least one of six security headers is absent. Everything comes from a single request made by our server, so the table is a snapshot of what an anonymous client received at that moment. Header names are lower-cased because that is how the fetch API reports them.
The six security headers it looks for
These are the headers that the tool reports as present or Not set. Their values matter as much as their presence, so read the table for the actual setting.
| Header | What it does | Example value |
|---|---|---|
| Strict-Transport-Security | Tells browsers to use HTTPS only for the host; honoured only when received over HTTPS | max-age=31536000; includeSubDomains |
| Content-Security-Policy | Restricts where scripts, styles, images and frames may load from | default-src 'self' |
| X-Frame-Options | Older control over embedding in frames | DENY or SAMEORIGIN |
| X-Content-Type-Options | Stops browsers from guessing a different content type | nosniff |
| Referrer-Policy | Controls how much of the page URL is sent as the Referer | strict-origin-when-cross-origin |
| Permissions-Policy | Turns browser features such as camera or geolocation on or off | camera=(), geolocation=() |
Caching and content headers worth checking
Beyond security, the table is a quick way to confirm caching behaviour. Cache-Control carries directives such as max-age, s-maxage for shared caches, no-store, and private. Note that no-cache means a cache must revalidate before reuse, not that it may not store the response. ETag and Last-Modified are validators that let a client ask whether its stored copy is still current. Content-Type should state the right media type and, for text, a charset. Content-Encoding shows whether the body was compressed with gzip or br. Vary lists request headers that change the response, and a missing Vary on content that does change by Accept-Encoding or language can cause caches to serve the wrong variant.
Example inputs and what to look for
Enter the exact page you care about, because headers can differ between the home page, static files and API routes. Try https://example.com/ for a baseline, then a path such as /assets/app.js to compare the caching headers of a static file with those of an HTML page. Static assets with fingerprinted file names usually carry a long max-age, while HTML pages usually carry a short one or no-cache. In the output, check that the final URL is the one you expected, that Strict-Transport-Security appears on the HTTPS response, and that nothing in the table exposes more than you intend, such as detailed server or framework version strings.
Learn more from an authoritative source:
MDN Web DocsRedirect Checker
Trace the full redirect chain for any URL — see each hop, status code, and the final destination.
TTFB Checker
Measure Time to First Byte (TTFB) for any URL — see how fast your server responds and identify bottlenecks.
Website Page Size Checker
Check the HTML page size of any URL and get a resource breakdown — images, scripts, stylesheets, and inline assets.
Website Screenshot Tool
Capture a full-page screenshot of any website URL without installing any software.
.htaccess Generator
Generate an Apache .htaccess file with HTTPS redirects, www rules, caching headers, and custom error pages.
JSON Formatter & Validator
Format, validate, and minify JSON — with clear error messages for invalid input.
Results are estimates for informational purposes only and do not constitute professional financial, medical, legal, or technical advice. Read full disclaimer →