Skip to content
XUtilHub

HTTP Headers Checker – View Response & Security Headers

See the HTTP response headers of any URL, the status code and response time, and grade its security headers: HSTS, CSP, X-Frame-Options and more.

  • Free, no sign-up
  • Checked from our server, nothing stored

About the HTTP Headers Checker

Inspect the headers a web server sends back: caching, content type, server and cookies, plus a grade for the security headers that protect visitors, with an explanation of each one.

Key features

  • All response headers
  • Status code and response time
  • Security headers grade
  • Follows redirects
  • Explains each security header
  • Copy headers as text

See what a server sends back

Headers control how browsers and search engines handle a page: whether it's cached, which language it's in, whether it may be shown in a frame, and more. This checker requests the URL and shows every header, plus a grade for security.

Security headers explained

HeaderProtects against
Strict-Transport-SecurityDowngrade attacks; forces HTTPS
Content-Security-PolicyCross-site scripting (XSS) and data injection
X-Content-Type-OptionsBrowsers running files as the wrong type
X-Frame-OptionsClickjacking through hidden frames
Referrer-PolicyLeaking full URLs to other sites
Permissions-PolicyUnwanted camera, microphone and location use

Headers that matter for SEO

  • X-Robots-Tag: can block indexing just like a robots meta tag.
  • Link (rel=canonical): sets the canonical URL for PDFs and other files.
  • Cache-Control: affects how fast repeat visits and crawls are.

Redirect checker, SSL checker, HTTP status codes and meta tag checker.

How to use the HTTP Headers Checker

  1. Enter a domain name or URL, such as example.com.
  2. Click the button, or try one of the examples.
  3. Our server runs the check and shows the results in a few seconds.
  4. Copy the results, or share the page link, which includes your query.

Frequently asked questions

What are HTTP headers?

Extra information a server sends with every page: the content type, caching rules, cookies, the server software and security instructions for the browser. You don't see them on the page, but they affect speed, SEO and security.

Which security headers should every site have?

Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options: nosniff, a frame protection header (X-Frame-Options or CSP frame-ancestors), Referrer-Policy and Permissions-Policy.

Why are some headers different from what my browser shows?

Servers can send different headers depending on the browser, cookies, location or whether you're logged in. Our check is a fresh, logged-out request from our server.

Should I hide the Server header?

It's a good idea. Showing exact software versions makes it easier for attackers to find known vulnerabilities. Most servers can be configured to hide or shorten it.

Are these network tools free?

Yes. All tools are free with no sign-up. To keep them fast for everyone, each visitor can run about 30 checks of each kind every five minutes.

Do you store the domains I check?

No. Lookups are run on demand and the results aren't saved. Your own IP address isn't stored either.

Where do the results come from?

DNS lookups query public resolvers (Cloudflare, Google and Quad9), WHOIS data comes from each registry's official RDAP or WHOIS service, and SSL and HTTP checks connect to the website directly from our server.

Can I check sites on my local network?

No. For security, our server only connects to public internet addresses, so localhost, 192.168.x.x and other private addresses are refused. The subnet calculator works with any address because it runs in your browser.

Last updated:

Related Network tools

Redirect CheckerNEW

Trace every redirect from a URL to its final page, with status codes (301, 302, 307, 308) and timings. Find redirect chains that hurt SEO and speed.

Is It Down?NEW

Check if a website is down for everyone or just you. See the status code and response time from our server, and what to try if it only fails for you.

Subnet CalculatorNEW

Calculate IPv4 subnets: network and broadcast address, usable host range, subnet and wildcard masks, host count, and split networks into smaller subnets.

What Is My IPNEW

See your public IP address instantly, whether it's IPv4 or IPv6, plus the browser, language, time zone and screen details websites can see.

DNS LookupNEW

Look up the DNS records of any domain: A, AAAA, CNAME, MX, NS, TXT, SOA and CAA, with TTLs. Reverse DNS for IP addresses. Free and instant.

WHOIS LookupNEW

Find when a domain was registered, how old it is, when it expires, its registrar and name servers. Works for .com, .pk, .in, .co.uk and most other domains.

SSL CheckerNEW

Check any website's SSL certificate: whether it's valid and trusted, when it expires, who issued it, which domains it covers, the TLS version and the full chain.