HTTP Headers Checker

See the HTTP status code, full redirect chain and response headers for any URL, and get a security headers grade with fixes.

Try: http://github.com, wikipedia.org, example.com

Redirect chain

1 request
#StatusURLTime
1 200 OK https://badssl.com 224 ms

Security headers

0/6F
  • Strict-Transport-Security
    Forces browsers to use HTTPS for future visits (HSTS).
  • Content-Security-Policy
    Restricts which scripts, styles and frames can load; the strongest defence against XSS.
  • X-Content-Type-Options
    Set to 'nosniff' to stop browsers guessing content types.
  • X-Frame-Options
    Prevents clickjacking by controlling who can frame the page (or use CSP frame-ancestors).
  • Referrer-Policy
    Controls how much of the URL is sent to other sites in the Referer header.
  • Permissions-Policy
    Turns off powerful browser features (camera, geolocation...) the site does not use.
HTTP/3: Not advertised (no h3 in Alt-Svc) · Server: nginx/1.10.3 (Ubuntu)

Response headers

https://badssl.com · 104.154.89.105
Servernginx/1.10.3 (Ubuntu)
DateTue, 13 Oct 2026 23:23:44 GMT
Content-Typetext/html
Last-ModifiedTue, 13 Oct 2026 21:00:30 GMT
Transfer-Encodingchunked
Connectionkeep-alive
ETagW/"6ace9bee-2d99"
Cache-Controlno-store
Content-Encodinggzip

What this HTTP header checker shows

Enter any URL and we request it from our server exactly as a browser would, without following redirects automatically. That lets us show you every hop in the redirect chain with its status code and response time, followed by the full response headers of the final page and a security headers grade.

HTTP status codes cheat sheet

CodeMeaningSEO note
200 OKThe page loaded normally.Indexable.
301 Moved PermanentlyPermanent redirect.Passes ranking signals; use for domain moves and HTTP→HTTPS.
302 / 307 Temporary redirectTemporary move.Search engines keep the original URL indexed.
308 Permanent RedirectLike 301 but keeps the request method.Treated like 301.
304 Not ModifiedCached copy is still valid.Normal for repeat visits.
403 ForbiddenAccess denied, often a firewall or bot protection.Can block crawlers.
404 Not FoundNo page at this URL.Drops out of the index over time.
410 GoneRemoved on purpose.Removed from the index faster than 404.
500 / 502 / 503Server or upstream error.Persistent 5xx errors hurt crawling.

Redirect best practices

  • Keep chains to one hop: http://example.com should go straight to https://www.example.com/, not via two or three intermediate URLs.
  • Use 301 or 308 for permanent moves, so search engines transfer ranking signals.
  • Avoid redirect loops and mixed HTTPS→HTTP hops.

Recommended security headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Add HSTS only once every subdomain supports HTTPS, and roll out CSP in Content-Security-Policy-Report-Only mode first. Check the TLS side with our SSL checker.

Frequently asked questions

Why do I see a 403 when the site works in my browser?

Some sites block automated requests or requests from cloud data centres with bot protection.

Which ports can I check?

Ports 80, 443, 8080 and 8443 on public addresses. Private and internal addresses are blocked for security.

Copied to clipboard