HTTP Header Checker

What is the HTTP Header Checker?

The HTTP Header Checker fetches any public URL and shows exactly what the server sends back before the page itself: the status code, the full redirect chain, caching and compression headers, cookies flags, and the security headers that browsers use to protect your visitors. It highlights the six security headers that matter most and tells you which are missing. Because browsers cannot read another site’s headers directly, this tool uses a small server-side fetcher on Toolz Directory; only the URL you type is sent.

How to use it

1. Paste a URL, including https://.
2. Click Check. The status line appears first, then the redirect chain if any, then the full header list.
3. Read the security summary: each of the six headers is marked present or missing with a one-line explanation.
4. Copy the raw headers if you need to paste them into a ticket.

The six security headers it checks

• Strict-Transport-Security forces HTTPS on return visits.
• Content-Security-Policy limits where scripts and other resources can load from, the main defence against cross-site scripting.
• X-Frame-Options (or CSP frame-ancestors) stops your pages being embedded in someone else’s frame for clickjacking.
• X-Content-Type-Options: nosniff stops browsers guessing file types.
• Referrer-Policy controls how much of your URL is leaked to sites you link to.
• Permissions-Policy switches off browser features (camera, geolocation) your site does not use.

What each one should be set to, and the copy-paste configuration for Apache, Nginx, Cloudflare and WordPress, is in how to check HTTP security headers and fix the six that matter.

Other things to look for

• Redirect chains. http to https to www to a trailing slash is three hops; each one costs time and a little link equity. Aim for one.
• Cache-Control on static assets should be long (a year) with versioned filenames; on HTML it should be short.
• Content-Encoding: br or gzip confirms compression is on. Its absence is a quick win.
• Server and X-Powered-By leak version numbers; remove them.
• Set-Cookie should carry Secure, HttpOnly and SameSite.

Related tools

Check the on-page side with the Meta Tag Extractor, run a broader audit with the SEO Site Analyzer, and confirm the robots rules with the Robots.txt Generator.

Frequently asked questions

Why does the tool show different headers from my browser’s dev tools?

Some servers vary headers by user agent, location or cookies. The tool requests as a plain client with no cookies, which is also how search engine bots see the page.

Can I check pages behind a login?

No. Only publicly reachable URLs.

Does a missing security header mean my site is hacked?

No. It means a protection is switched off. Adding the headers is usually a few lines of server configuration.

Is the URL I check stored?

It is used for the request and not kept.