What a server really sends
Enter a URL and our server requests it the way a browser would, following up to 10 redirects. You'll see the full redirect chain with each status code (301, 302, 307, 308) and response time, then every response header from the final page: caching, compression, content type, cookies and server details.
The security headers report grades the page from A+ to F on the headers that protect visitors: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — each with a plain-English note. It also flags headers that leak server or framework versions.
How to check HTTP headers
- 1
Enter a URL
http:// and https:// both work.
- 2
Review the redirect chain
Every hop with status and timing.
- 3
Check the security grade
Fix missing headers first.
- 4
Copy the raw headers
For tickets or documentation.
Key features
Full redirect chain
Spot redirect loops and extra hops.
Security grade
Six key headers checked and explained.
Version leak warnings
Server and X-Powered-By details flagged.
Raw header export
Copy exactly what the server returned.
Common uses
- SEO audits: Confirm 301 redirects and HTTPS redirects are set up correctly.
- Security reviews: Find missing HSTS, CSP and clickjacking protection.
- Caching checks: Verify Cache-Control and compression on key pages.
Tips and good to know
- Use 301 or 308 redirects for permanent moves so search engines transfer ranking to the new URL.
- Check the certificate behind an HTTPS site with the SSL Checker.