HTTP header checker — see what a server really sends back.
Enter a URL to read the response headers of the final page, with a quick review of its security headers and cache settings.
Check response headers
Live checkTurn any long URL into a short, trackable link.
Once the destination checks out, shorten it with click analytics by source, location and device, all in one dashboard.
What are HTTP response headers?
Metadata the server sends before the page itself.
Every HTTP response starts with a status line and a block of headers. They tell the browser what kind of content is coming, how long it can be cached, whether it may be shown in a frame, and which security rules apply.
Headers are invisible in the page, which makes them easy to get wrong. A missing Cache-Control header can make a CDN cache the wrong thing, and a missing security header leaves a site open to attacks the browser would otherwise block.
This tool reads the headers the way a client would and flags the common ones that are missing. The review is a checklist of widely recommended defaults, not a full security audit.
Security headers worth having
What each one protects against.
| Header | Purpose | Typical value |
|---|---|---|
| Strict-Transport-Security | Makes browsers use HTTPS only for the site. | max-age=31536000; includeSubDomains |
| Content-Security-Policy | Limits where scripts, styles and frames may load from. | default-src 'self' |
| X-Content-Type-Options | Stops browsers guessing a file's type. | nosniff |
| X-Frame-Options | Controls whether other sites can embed the page in a frame. | DENY or SAMEORIGIN |
| Referrer-Policy | Limits how much of the URL is shared with other sites. | strict-origin-when-cross-origin |
| Permissions-Policy | Switches off browser features the site doesn't use. | camera=(), microphone=() |
Common questions
Which response is shown when there are redirects? +
The final one. The tool follows redirects like a browser and shows the headers of the page you end up on. Use the redirect checker to see the headers' status code at each hop.
Does a missing header mean the site is insecure? +
Not necessarily. The review lists recommended defaults, and some sites have good reasons to skip one. It is a prompt to check, not a verdict.
Why do I see different headers in my browser? +
Servers can vary their response by user agent, cookies, language or location, and CDNs add their own headers. This tool shows what an anonymous request from our server receives.
Is the Server header a risk? +
Revealing the software name or version isn't a vulnerability by itself, but it helps attackers choose what to try. Removing or generalising it is a small hardening step.