HTTP response header check
See exactly what the server returns: security headers, caching, compression and the full redirect chain.
What we check
Grouped into security, caching, SEO and server categories, each with a one-line explanation.
- Security headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
- Caching headers — Cache-Control, ETag, Vary, and CDN cache status
- Redirect chain — every hop's status code and target, flagging 301/302 mixing
- SEO-related — X-Robots-Tag (an accidental noindex), Content-Type and charset
- Compression — whether br or gzip is enabled
- Information leakage — whether Server or X-Powered-By exposes versions or stack
How it works
Enter a URL
http:// and https:// both supported
Read the headers
Grouped, with a plain-language note on each one
Read the findings
Missing key headers, weak HSTS, redirect problems
Other free tools
FAQ
Why do you use GET instead of HEAD?
Many sites return different headers for HEAD than for GET. We send GET and disconnect as soon as the headers arrive — so you see what a real visitor gets.
How many redirects do you follow?
Up to six. Beyond that it is almost always a misconfiguration or a loop.
Does a missing security header mean the site is unsafe?
No. Security headers are defence in depth — missing ones widen the risk surface but do not mean a site has been compromised.
Are the headers always identical?
Different CDN nodes and regions can return slightly different headers. That is normal.
Headers are part of technical SEO
Security headers, caching policy and redirect hygiene all shape how search crawlers treat your site.