Skip to content
SiteFaults

Free HTTP header checker

An HTTP header checker that shows the full response headers a URL returns — status, content type, caching, compression and security headers — and flags the security headers worth having that are missing. The metadata that controls how browsers and crawlers treat your page, made visible.

Enter a URL. We show every response header it returns and check the security headers worth having.

The part of the response you never see

Every page a server sends comes in two parts: the HTML you can read, and a set of headers you cannot, sent ahead of it. Those headers decide how long the browser caches the page, whether the connection is pinned to HTTPS, whether the content is compressed, and — crucially for SEO — whether the server quietly attached a noindex instruction. Because none of this shows up in the rendered page or the view-source, header problems are among the hardest to spot by eye. Listing them is the whole job.

The header that hides a de-indexing

The X-Robots-Tag header can carry a noindex directive exactly like the robots meta tag, but with one difference that makes it far more dangerous: it is invisible in the HTML. A page can look perfect, have a clean robots meta tag, and still be told not to be indexed by a header applied at the CDN or server level that nobody remembers setting. If a page has dropped out of Google and its on-page tags are clean, this header is the next place to look — and this tool puts it in plain sight.

Security headers are configuration, not code

The security headers worth having — Strict-Transport-Security, X-Content-Type-Options, a framing policy — each shut down a class of attack, and none of them require touching your application code. They are server or CDN configuration, which makes their absence a cheap thing to fix and an easy thing to overlook. This tool checks for them so a working site does not lull you into thinking a hardened one.

Where this fits

Headers touch both security and speed, and they sit next to the other server-level checks. The redirect checker traces a full redirect chain; the SSL certificate checker confirms the HTTPS the HSTS header enforces; the indexability checker reads the X-Robots-Tag alongside the other indexing signals. For everything scored together in one pass, run the free website checker, and what counts as a good score explains the result.

HTTP header questions

What does an HTTP header checker do?
An HTTP header checker sends a request to a URL and shows you the full set of response headers the server sends back — the status code, content type, caching rules, compression, and security headers — alongside the visible page. It then checks the security-relevant headers worth having and flags the ones that are missing, so you can see both what the server declares and what it should but does not.
What are HTTP response headers?
HTTP response headers are metadata the server sends with every page, separate from the page content itself. They tell the browser how to handle the response: what type of content it is, how long it may be cached, whether it is compressed, whether the connection must stay on HTTPS, and more. They are invisible in the rendered page but they control a great deal of how the browser and search engines treat it.
Which security headers should my site have?
The high-value ones are Strict-Transport-Security (forces HTTPS on future visits), X-Content-Type-Options set to nosniff (stops content-type guessing), and a Content-Security-Policy or X-Frame-Options (limits clickjacking). Referrer-Policy and Permissions-Policy are useful additions. None of these change how the page looks, and each closes off a class of attack — which is why their absence is worth flagging even on a site that seems to work fine.
What is the X-Robots-Tag header and why does it matter for SEO?
X-Robots-Tag is a response header that can carry the same instructions as the robots meta tag — including noindex. Because it lives in the header rather than the HTML, it is invisible when you view the page source, which makes an accidental noindex here one of the hardest indexing problems to diagnose. It is applied at the server or CDN level and often forgotten. This tool surfaces it directly so it cannot hide.
What do Cache-Control and Content-Encoding headers do?
Cache-Control tells browsers and CDNs how long they may reuse a response instead of re-fetching it, which is central to fast repeat visits. Content-Encoding shows whether the response is compressed with gzip or Brotli, which shrinks the transfer and speeds up the first load. Both are performance headers: getting them right is some of the cheapest speed you can buy, since it is configuration rather than code.
Does this follow redirects?
It reports the headers of the response at the URL you enter, including a redirect status such as 301 or 302 and the Location header it points to, so you can see the redirect itself. To trace a full chain of several redirects hop by hop — which is a different question — use the dedicated redirect checker, which follows each step and flags loops.
What security headers should my website have?
The core set is Strict-Transport-Security to enforce HTTPS, X-Content-Type-Options to stop MIME sniffing, a Content-Security-Policy to limit where resources load from, and a Referrer-Policy to control what you leak on outbound links. Adding X-Frame-Options or a frame-ancestors directive to block clickjacking rounds out the basics.
What is the difference between a request header and a response header?
A request header is sent by the browser to the server describing what it wants, such as which formats it accepts, while a response header is returned by the server describing what it sent, such as the content type and caching rules. This tool reads the response headers a server returns for a URL.
What does the HSTS header do?
Strict-Transport-Security tells browsers to only ever connect to your site over HTTPS for a set period, so a user typing the bare domain is never sent over insecure HTTP first. It closes the small window where an attacker could intercept that initial redirect, which is why it is a standard hardening step once HTTPS is stable.
How do I check the HTTP status code of a URL?
Enter the URL above and this tool reports the status code the server returns, such as 200 for OK, 301 or 302 for a redirect, or 404 for not found. Seeing the code directly is useful when a page looks fine in a browser but search engines are treating it as an error.
What is the Content-Security-Policy header?
Content-Security-Policy is a header that tells the browser which sources it may load scripts, styles, images and other resources from, which sharply limits cross-site scripting attacks. It is one of the strongest security headers available, though it needs testing because an overly strict policy can block legitimate resources.