HTTP Header Checker

Check the HTTP headers, status codes and redirect chain of any URL – with a rating of security headers such as HSTS, CSP and X-Frame-Options.

Runs on the no.tools server – nothing is stored

The check runs on the no.tools API, because browsers may not read other sites’ headers. Only the headers are fetched; nothing is stored.

About this tool

Before a browser shows a page, the server sends headers: status code, redirects, caching rules and security settings. The HTTP header checker shows you this response step by step – useful for testing redirects after a move, checking http-to-https redirects or finding out why a page does not get cached.

It also rates the most important security headers such as HSTS, Content-Security-Policy, X-Content-Type-Options and clickjacking protection and points out version details and insecure cookies. Because browsers may not read other sites’ headers, the request runs on the no.tools API; only the headers are fetched and nothing is stored. The meaning of the codes is explained by the HTTP Status Codes.

How it works

  1. Enter an address, e.g. example.com or a full URL.
  2. Click “Check”.
  3. Follow the redirect chain with the status code and response time of every step.
  4. Look at the rating of the security headers and all headers of the final response.

Frequently asked questions

Why does the check run on a server?

For security reasons a website in the browser may not read the response headers of other sites (same-origin policy). That is why the no.tools API fetches the address and returns status codes and headers. The page content is not loaded and nothing is stored.

Which security headers matter?

Strict-Transport-Security enforces HTTPS, Content-Security-Policy protects against injected scripts, X-Content-Type-Options: nosniff stops browsers from reinterpreting files and X-Frame-Options or frame-ancestors protects against clickjacking. Referrer-Policy and Permissions-Policy are useful additions.

How many redirects are fine?

Ideally at most one, e.g. from http://example.com straight to https://www.example.com. Every additional one costs loading time; search engines only follow chains up to a certain length. The tool stops after ten – that usually points to a loop.

Which addresses can I check?

All publicly reachable web servers over http or https. Internal addresses such as localhost, 192.168.x.x or .local are excluded. The check is subject to the API’s usage limits (currently 30 per minute).

More Network tools

Bandwidth CalculatorHow long does a download take? Calculate transfer times, the bandwidth you need for a file size and convert data rates such as Mbit/s to MB/s.DNS LookupLook up DNS records (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA and more) for any domain, or the reverse DNS of an IP — via DNS-over-HTTPS.E-Mail Security CheckCheck the e-mail security of a domain: MX, SPF (incl. lookup count), DMARC, DKIM, MTA-STS, TLS-RPT and BIMI – with explanations and tips against spoofing and spam folder problems.HTTP Status CodesAll HTTP status codes explained – from 200 OK and 301 redirects to 404, 429 and 503, plus common unofficial codes from nginx and Cloudflare.IP Address ConverterConvert IPv4 and IPv6 addresses: decimal, hex, binary, short and full notation, IPv4 in IPv6 (mapped, 6to4, NAT64) and reverse DNS names.CIDR Range CalculatorConvert IP ranges into CIDR blocks, merge lists of networks into the shortest form and check whether an IP is contained – for IPv4 and IPv6.MAC Address ToolLook up the vendor of a MAC address (IEEE list), convert between notations, check unicast/multicast and local bits, derive the IPv6 link-local address and create random MAC addresses.What Is My IP?Shows your public IP address (IPv4 or IPv6), your internet provider and the approximate location derived from it — plus what your browser reveals about you.Port LookupWhich service uses which port? Searchable list of the most important TCP and UDP ports – from 22 (SSH) and 443 (HTTPS) to databases, VPNs and game servers.IP Subnet CalculatorCalculate IPv4 and IPv6 subnets: network, broadcast, netmask, wildcard and host range in CIDR notation, IPv6 prefixes and address types – and split networks into smaller subnets.WHOIS / RDAP LookupLook up who a domain, IP address or AS number belongs to: registrar, registration and expiry date, status, name servers and network owner – via the official RDAP service of the registries.