HTTP Header Checker
Fetch any URL and inspect its status code and full set of response headers — caching, content type, security policy and redirects.
What is an HTTP header checker?
Every time a browser loads a page, the server replies with a status code and a set of HTTP headers that describe the response. Those headers control caching, compression, cookies, redirects and critical security policies. This tool sends a request to the URL you enter and shows you exactly what came back — invaluable for debugging caching, CDN behaviour, redirects and missing security headers.
Headers worth checking
- Cache-Control / ETag — how long clients and CDNs cache the response.
- Content-Type / Content-Encoding — the format and compression.
- Strict-Transport-Security — forces HTTPS for future visits.
- Content-Security-Policy — mitigates XSS and injection.
- Server / X-Powered-By — what's serving the response (consider hiding these).
How to use it
- 1Enter a URL — https:// is assumed if you omit the scheme.
- 2Click Fetch headers to make the request.
- 3Read the status badge and any redirect target.
- 4Scan the header table for caching, content and security fields.
Frequently asked questions
What are HTTP response headers?+
Response headers are metadata a server sends alongside a web page or API response. They control caching (Cache-Control, ETag), content type, compression, cookies, redirects (Location), and security policy (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options).
Which security headers should my site send?+
At a minimum consider Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options: nosniff, and X-Frame-Options or a frame-ancestors CSP directive. This tool lets you confirm they're present and correctly set.
Does it follow redirects?+
No — it reports the redirect status and the Location header but does not follow it. That lets you see each hop and, for security, prevents the tool from being bounced to an internal address.
How do I check my cache headers?+
Run the check and look at Cache-Control, Expires, ETag and Age. These determine how long browsers and CDNs store your responses. A missing or overly short Cache-Control on static assets is a common performance issue.