Cek Header HTTP

See the HTTP status code, full redirect chain and response headers for any URL, and get a security headers grade with fixes.

Rantai redirect

1 request
#StatusURLWaktu
1 200 OK https://github.com 28 ms

Header keamanan

5/6B
  • Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
    Memaksa browser menggunakan HTTPS pada kunjungan berikutnya (HSTS).
  • Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; con…
    Membatasi skrip, gaya, dan frame mana yang boleh dimuat; pertahanan terkuat terhadap XSS.
  • X-Content-Type-Options: nosniff
    Atur ke 'nosniff' agar browser tidak menebak tipe konten.
  • X-Frame-Options: deny
    Mencegah clickjacking dengan mengatur siapa yang boleh menampilkan halaman dalam frame (atau gunakan CSP frame-ancestors).
  • Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
    Mengatur seberapa banyak URL yang dikirim ke situs lain melalui header Referer.
  • Permissions-Policy
    Menonaktifkan fitur browser yang canggih (kamera, geolokasi, dll.) yang tidak digunakan situs.
HTTP/3: Tidak diumumkan (tidak ada h3 di Alt-Svc) · Server: github.com

Header respons

https://github.com · 140.82.114.4
DateSat, 17 Oct 2026 04:16:41 GMT
Content-Typetext/html; charset=utf-8
content-languageen-US
VaryX-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, X-GitHub-Client-Version, Accept-Language, Sec-Fetch-Site,Accept-Encoding, Accept, X-Requested-With
ETagW/"dcbe11ed1b9cff661a54f38e0f264268"
Cache-Controlmax-age=0, private, must-revalidate
Strict-Transport-Securitymax-age=31536000; includeSubdomains; preload
X-Frame-Optionsdeny
X-Content-Type-Optionsnosniff
X-XSS-Protection0
Referrer-Policyorigin-when-cross-origin, strict-origin-when-cross-origin
Content-Security-Policydefault-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com api.github.com/cmc_internal/api/ edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com *.googleusercontent.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com 'sha256-tSjmyPUky1KbRZ0fw9VUil3wFEbeM82rtbJDygGJAXw='; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
Servergithub.com
Content-Encodinggzip
Accept-Rangesbytes
Set-Cookie_gh_sess=dbZjUcwBzrFSM5Vt4b8gDGzFaw%2BsW6mdW9jH72TN8d2mkeUJ%2F%2FGDVw4BDf%2FoWZwIJFwFooowgymP%2FPbhACf6KtgOcOKOQJAyq1yuMn5GMP4J4krxab5nVG1OD3OZoenHyUUMLesc5PS4zJczLjYaSjn62lLN98qJJJIr1lgHFxHxRVXuS1RYRm4Ee2SVmDB2TiapM7e%2BxeE18yiC0YxTxDJ90YJ60qUUBvUT%2B1tvfpygqp9jjicLsveHdKCYKMGjqsE1rKnwEEvdZi7Zi88b1Q%3D%3D--wvcUMZg4RxjHqf7i--1rbVbHhdLk6MudeVn7GEGw%3D%3D; path=/; HttpOnly; secure; SameSite=Lax
Set-Cookie_octo=GH1.1.1273407032.1792210605; expires=Sun, 17 Oct 2027 04:16:45 GMT; domain=.github.com; path=/; secure; SameSite=Lax
Set-Cookielogged_in=no; expires=Sun, 17 Oct 2027 04:16:45 GMT; domain=.github.com; path=/; HttpOnly; secure; SameSite=Lax
X-GitHub-Request-Id2682:695C6:9C3D7E:C5663D:6AD2F6AD
x-github-edge-regioniad
Transfer-Encodingchunked

Yang ditampilkan pemeriksa header HTTP ini

Masukkan URL apa pun dan kami memintanya dari server kami persis seperti yang dilakukan browser, tanpa mengikuti redirect secara otomatis. Dengan begitu kami bisa menampilkan setiap lompatan dalam rantai redirect beserta kode status dan waktu responsnya, diikuti header respons lengkap dari halaman akhir dan nilai header keamanan.

Daftar ringkas kode status HTTP

KodeArtiCatatan SEO
200 OKHalaman dimuat dengan normal.Dapat diindeks.
301 Moved PermanentlyRedirect permanen.Meneruskan sinyal peringkat; gunakan untuk pemindahan domain dan HTTP→HTTPS.
302 / 307 Temporary redirectPemindahan sementara.Mesin pencari tetap mengindeks URL asli.
308 Permanent RedirectSeperti 301 tetapi mempertahankan metode permintaan.Diperlakukan seperti 301.
304 Not ModifiedSalinan cache masih valid.Normal untuk kunjungan berulang.
403 ForbiddenAkses ditolak, sering kali karena firewall atau perlindungan bot.Dapat memblokir crawler.
404 Not FoundTidak ada halaman di URL ini.Lama-kelamaan keluar dari indeks.
410 GoneSengaja dihapus.Dihapus dari indeks lebih cepat daripada 404.
500 / 502 / 503Error server atau upstream.Error 5xx yang terus-menerus merugikan proses crawling.

Praktik terbaik redirect

  • Jaga rantai tetap satu lompatan: http://example.com harus langsung menuju https://www.example.com/, bukan lewat dua atau tiga URL perantara.
  • Gunakan 301 atau 308 untuk pemindahan permanen, agar mesin pencari memindahkan sinyal peringkat.
  • Hindari loop redirect dan lompatan HTTPS→HTTP campuran.

Header keamanan yang direkomendasikan

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Tambahkan HSTS hanya setelah setiap subdomain mendukung HTTPS, dan terapkan CSP dalam mode Content-Security-Policy-Report-Only terlebih dahulu. Periksa sisi TLS dengan Cek Sertifikat SSL kami.

Pertanyaan yang sering diajukan

Mengapa saya melihat 403 padahal situsnya berfungsi di browser saya?

Sebagian situs memblokir permintaan otomatis atau permintaan dari pusat data cloud dengan perlindungan bot.

Port mana saja yang bisa saya periksa?

Port 80, 443, 8080, dan 8443 pada alamat publik. Alamat privat dan internal diblokir demi keamanan.

Diperbarui

Tersalin ke clipboard