HTTP Header Checker

What this HTTP header checker shows

Enter a URL and the HTTP header checker requests it from our server, then shows every response header, the status code and each step of any redirect chain, with the time each step took. Headers are the instructions a server sends before the page itself: whether it moved, how long it can be cached, whether search engines may index it, and which security protections are on.

You can also request the page as Googlebot, Bingbot or an iPhone. Some servers, CDNs and security plugins answer bots differently from browsers, and that’s exactly the kind of problem that quietly stops pages from ranking.

How to use the HTTP header checker

1. Paste the full URL, or just the domain.
2. Choose who to request it as. Pick Googlebot smartphone to see what Google’s main crawler gets.
3. Press Check headers. The redirect chain lists every hop; click one to see that hop’s headers.
4. Read the two checklists: SEO and performance, and security headers with a grade from A to F.
5. Copy the raw headers for a bug report, or copy a link to the same check to send to a developer.

Redirects and status codes

Status	Meaning	What to do
200	OK	Nothing, the page loads normally.
301 / 308	Moved permanently	Right for changed URLs. Update internal links to the new address.
302 / 307	Moved temporarily	Use only for short-term moves; for permanent changes switch to 301.
404 / 410	Not found / gone	Fix the link or redirect it to the closest page.
5xx	Server error	Check server logs; repeated errors cause search engines to crawl less.

Each redirect adds a round trip, so chains like http → https → www → final page slow the first visit down. Point links and canonical tags straight at the final URL.

Headers that matter for SEO

• X-Robots-Tag: can say noindex for the whole response, just like a meta robots tag. It’s often set by accident on PDFs, staging copies or after a migration, so it’s worth checking first when a page won’t index.
• Link rel=”canonical”: some sites set the canonical URL in a header instead of the HTML.
• Cache-Control, ETag and Last-Modified: control how long browsers keep a copy and let them check for changes cheaply. Last-Modified also shows when the server thinks the page last changed.
• Content-Encoding: shows whether text is compressed with gzip or Brotli, which makes pages download faster.

Security headers explained

The HTTP header checker grades six common protections. Strict-Transport-Security keeps visitors on HTTPS. Content-Security-Policy limits which scripts can run, which is the strongest defence against cross-site scripting. X-Frame-Options (or a CSP frame-ancestors rule) stops other sites framing your page. X-Content-Type-Options, Referrer-Policy and Permissions-Policy close smaller gaps. A missing header isn’t a hack; it’s a missing layer of protection. MDN’s HTTP headers reference documents every header in detail.

How to check HTTP headers in Chrome

1. Open the page, then press F12 (Cmd + Option + I on a Mac) to open DevTools.
2. Go to the Network tab and reload the page.
3. Click the first request in the list, which is the page itself.
4. Open Headers and scroll to Response Headers.

That shows what your own browser received. The HTTP header checker is quicker for comparisons, because it shows the full redirect chain in one place and can request the page as Googlebot.

Related tools

Check whether AI crawlers can reach your site with the AI Crawler Access Checker, generate crawl rules with the Robots.txt Generator, and find dead links with the Broken Links Checker.

Frequently asked questions

Why do I get different headers from what my browser shows?

Our request comes from a server, not your browser, and without your cookies. CDNs, caching plugins and firewalls can also answer differently depending on location and user agent. Try the Googlebot or iPhone option to compare.

Can the HTTP header checker see pages behind a login?

No. It only sees what a visitor without an account would get.

What does the security grade mean?

It counts how many of the six common security headers are present: all six is an A, none is an F. It doesn’t check whether each value is configured well.

Why does the response time look slow?

It’s measured from our server to yours, including the network distance between them, so treat it as a rough guide rather than what your visitors see.