Is this checked from my browser or your server?

From the server. That means it can check any publicly reachable URL, not just ones your own browser can load, but it also means it can't see headers on sites that require you to be logged in.

Is the URL I enter stored anywhere?

No. The request is made, the result is shown to you, and nothing is logged or saved afterward.

Why can't I check an internal or localhost address?

The tool deliberately blocks private and reserved IP ranges (like localhost or internal LAN addresses) as a security precaution, since this runs server-side.

What do the flagged security headers actually do?

Headers like Content-Security-Policy and X-Frame-Options tell browsers how to handle your content defensively — for example, preventing your pages from being embedded in a malicious iframe. Missing one isn't automatically a serious problem, but it's worth a deliberate decision rather than an oversight.

Why do I only see the final URL's headers?

This tool follows redirects (up to 5 hops) and reports the final response's status, headers, and effective URL — the intermediate hops are not shown. If you need to see each hop, use curl without -L, or open the Network tab in DevTools with "Preserve log" enabled and watch the redirect sequence yourself.

Should I hide the Server header?

It is low-risk either way: obscurity is not security, and scanners fingerprint software regardless of banners. Still, suppressing version banners like Server and X-Powered-By is cheap hygiene that shrinks what automated scanners learn about your stack for free — do it, but don't mistake it for hardening.

What does "cache-control: max-age=0, must-revalidate" mean?

The response may be stored, but it must be revalidated with the server before every reuse — effectively "always check for a fresh copy". It is the standard setting for HTML pages that change often, paired with ETag or Last-Modified so each revalidation is a cheap 304 instead of a full download.

HTTP Header Checker

An HTTP header checker fetches any URL and shows you the response headers — the invisible metadata a server sends before the page itself. Headers control caching, security policy, cookies, compression, and redirects, so reading them is the fastest way to debug a slow page, a broken redirect, or a missing security policy. This guide explains the important headers in plain language and lists the security headers your site should send. For the security side in depth, read HTTP Security Headers Explained.

Anatomy of a response

Every HTTP response has three parts: a status line (HTTP/2 200), the headers (key–value metadata), and the body (the page, image, or API payload). This tool shows the first two. The status code tells you what happened — 200 OK, 301 moved, 404 missing, 500 server error — and the headers fill in the details: where a redirect points, how long the response may be cached, and which security policies apply.

Headers worth knowing

Header	What it means
`Content-Type`	Media type of the body, e.g. `text/html; charset=utf-8`. A wrong type breaks rendering.
`Cache-Control`	Caching instructions: `max-age=3600` allows one hour of caching; `no-store` forbids it.
`ETag` / `Last-Modified`	Validators for conditional requests — let browsers revalidate instead of re-downloading.
`Location`	Where a 3xx redirect sends the browser. Always inspect this when debugging redirect loops.
`Set-Cookie`	Cookies the server wants stored. Look for the `Secure`, `HttpOnly`, and `SameSite` flags.
`Access-Control-Allow-Origin`	Which sites may read this response via JavaScript (CORS). A value of `*` means anyone.
`X-Robots-Tag`	Indexing directives for non-HTML files, e.g. `noindex` on a PDF.
`Server` / `X-Powered-By`	Software banners. Harmless, but they advertise version details to scanners — many sites hide them.

Security headers: what to aim for

These headers switch on browser-side protections. Check that your site sends them:

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin

HSTS forces HTTPS for a year, defeating SSL-stripping attacks. Only add includeSubDomains once every subdomain serves HTTPS.
CSP whitelists where scripts and resources may load from — the strongest available defense against cross-site scripting.
X-Frame-Options (or CSP's frame-ancestors) blocks clickjacking by controlling who may embed your pages.
nosniff stops browsers from guessing content types, closing off a class of drive-by attacks.

Redirects and caching clues

This tool follows redirects (up to 5 hops) and shows the final response's status code, headers, and effective URL — it does not display each intermediate hop. More than one hop is a chain: each adds a round trip and dilutes SEO value, so flatten them server-side. If you need to see each hop, use curl without -L or watch the Network tab with "Preserve log" enabled.

For caching, compare Cache-Control against reality: max-age=0, must-revalidate means "always check back with the server", while public, max-age=31536000, immutable on versioned assets means "cache for a year, never ask again". If a CDN sits in front, extra headers like Age or X-Cache reveal whether the response came from cache (HIT) or origin (MISS).

How to use it

Enter the full URL, including https://.
Submit — the server sends a HEAD request, follows up to 5 redirects, and shows the final response's status code, headers, and a ✓/✗ security-header check. Nothing you enter is stored.

How it works

The server makes a HEAD request to the URL you enter using PHP's cURL extension, following redirects up to 5 hops, and reads back the final response's headers. This happens server-side, so it works the same regardless of your own browser or network.

Limitations

Private, internal, and localhost addresses are blocked as a security precaution. Sites that require a login or block automated requests may return different headers than what a logged-in visitor would see.

What this tool can't see

Some headers only appear in specific contexts: Set-Cookie values tied to a logged-in session, CORS preflight responses to OPTIONS requests, and headers a CDN adds only for certain regions. Redirect hops are followed but not displayed — only the final response's headers are shown. If a header you expect is missing here, re-check with curl -I using the same conditions a real visitor would hit — same protocol, same hostname, same path.

Frequently asked questions

Is this checked from my browser or your server?: From the server. That means it can check any publicly reachable URL, not just ones your own browser can load, but it also means it can't see headers on sites that require you to be logged in.
Is the URL I enter stored anywhere?: No. The request is made, the result is shown to you, and nothing is logged or saved afterward.
Why can't I check an internal or localhost address?: The tool deliberately blocks private and reserved IP ranges (like localhost or internal LAN addresses) as a security precaution, since this runs server-side.
What do the flagged security headers actually do?: Headers like Content-Security-Policy and X-Frame-Options tell browsers how to handle your content defensively — for example, preventing your pages from being embedded in a malicious iframe. Missing one isn't automatically a serious problem, but it's worth a deliberate decision rather than an oversight.
Why do I only see the final URL's headers?: This tool follows redirects (up to 5 hops) and reports the final response's status, headers, and effective URL — the intermediate hops are not shown. If you need to see each hop, use curl without -L, or open the Network tab in DevTools with "Preserve log" enabled and watch the redirect sequence yourself.
Should I hide the Server header?: It is low-risk either way: obscurity is not security, and scanners fingerprint software regardless of banners. Still, suppressing version banners like Server and X-Powered-By is cheap hygiene that shrinks what automated scanners learn about your stack for free — do it, but don't mistake it for hardening.
What does "cache-control: max-age=0, must-revalidate" mean?: The response may be stored, but it must be revalidated with the server before every reuse — effectively "always check for a fresh copy". It is the standard setting for HTML pages that change often, paired with ETag or Last-Modified so each revalidation is a cheap 304 instead of a full download.