HTTP Header Checker
Fetches a URL and shows the headers the server sent back, along with a check of the security headers it did and did not set. Enter a URL, as "https://example.com", or just a domain — https is assumed.
Fetches a URL and shows the headers the server sent back, along with a check of the security headers it did and did not set. Enter a URL, as "https://example.com", or just a domain — https is assumed.
Only the headers are read. The page itself is never downloaded, and redirects are not followed: a redirect is reported with its target so you can check that address on its own.
Where a tool elsewhere in this catalogue generates one of these headers, this is how you confirm the server is really sending it.
Use cases
- Confirming a Content-Security-Policy is live after deploying it
- Checking whether a site sets HSTS, and with what max-age
- Seeing which server software a site announces in its headers
FAQ
Is my data sent to a server?
Yes — the fetch runs on the server, which requests the URL on your behalf and reports the headers that came back.
Can I check a site on my own network?
No. Only publicly routable addresses are fetched. A URL that resolves to a private, loopback, or link-local address is refused, because a public tool that could reach private networks would be usable against the machines it runs on.
Why are redirects not followed?
Because the destination is chosen by the site being checked, which would sidestep the address rules above. The Location header is shown so you can check the destination yourself.
Can I check a port other than 80 or 443?
No. Allowing any port would make this a port scanner aimed at whoever you named, which is not something this site offers.
A header is missing — is that a problem?
Not necessarily. Each one is listed with what it does, so you can judge whether it matters for that site. A static page with no scripts needs far less than an application handling logins.