HTTP Header Checker
Enter a URL to see its response headers, status code, and which common security headers are missing.
How to use it
- Enter the full URL, including
https://. - Submit to see the response status, all headers, and a plain security-header check.
How it works
The server makes a HEAD request to the URL you enter using PHP's cURL extension, following redirects up to 5 hops, and reads back the final response's headers. This happens server-side, so it works the same regardless of your own browser or network.
Limitations
Private, internal, and localhost addresses are blocked as a security precaution. Sites that require a login or block automated requests may return different headers than what a logged-in visitor would see.
Frequently asked questions
- Is this checked from my browser or your server?
- From the server. That means it can check any publicly reachable URL, not just ones your own browser can load, but it also means it can't see headers on sites that require you to be logged in.
- Is the URL I enter stored anywhere?
- No. The request is made, the result is shown to you, and nothing is logged or saved afterward.
- Why can't I check an internal or localhost address?
- The tool deliberately blocks private and reserved IP ranges (like localhost or internal LAN addresses) as a security precaution, since this runs server-side.
- What do the flagged security headers actually do?
- Headers like Content-Security-Policy and X-Frame-Options tell browsers how to handle your content defensively — for example, preventing your pages from being embedded in a malicious iframe. Missing one isn't automatically a serious problem, but it's worth a deliberate decision rather than an oversight.