CodesBeautify

HTTP Header Checker

Send a request to a URL and read back the status, timing, every response header and which security headers are missing.

URL
Response
Looks this up through our server; only what you enter is sent, nothing is stored

About the HTTP Header Checker

Response headers are where a server states its caching rules, content type, cookies policy, redirects and security posture, and they are invisible in the browser unless you open the developer tools. This page fetches the URL from our edge, follows redirects, and lists the final status code, the response time, the content type and every header the server sent. It also scores six security headers that most audits look for: HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.

It is the quickest way to verify a deploy: is the cache header what the config says, did the CDN add its own headers, is the site sending a CSP at all, is the redirect from http to https in place. Because the request comes from a datacentre rather than your machine, it also shows what search engines and other bots receive, which can differ from what a logged-in browser sees.

The URL you enter is fetched by our function with a plain GET and no cookies or credentials; the body is discarded and nothing is stored. Private and internal addresses are refused. To watch each redirect hop use the redirect checker; to read the HTML itself use the source code viewer.

How to use

  1. Enter a full URL; https:// is assumed if you leave the scheme out.
  2. Press Check and read the status, timing and the security header checklist.
  3. Scroll the full header list to inspect caching, cookies and server details.
  4. Copy or download the result for a ticket or a report.

Common questions

Why does the status differ from what I see in the browser?
The request is made without your cookies and from a datacentre address. Pages that vary by login, geography or bot detection can answer differently.
What does a missing security header mean?
The site works without them, but each one closes a class of attack: HSTS forces https, CSP limits script sources, X-Content-Type-Options stops MIME sniffing, and so on. Missing ones are worth adding.
Are request headers configurable?
Not here. The API tester lets you set the method, headers and body of the request.