Check HTTP Headers

Check HTTP Headers for Any URL

Enter a URL starting with http:// or https:// and the tool sends a GET request, follows any redirects, and prints the status code and response headers for every hop. A typical result for a bare domain shows a 301 from http:// to https://, sometimes a second 301 to the www host, and then the final 200.

The request identifies itself with the User-Agent httpfy.io and gives up after 30 seconds. Some sites answer bots differently from browsers, so a firewall or CDN may return a 403 here even when the page loads fine for you.

Request and Response Headers

1. Request headers go from the client to the server: User-Agent, Accept, Authorization, Cookie.
2. Response headers come back from the server: Content-Type, Cache-Control, Set-Cookie, Location. This tool shows these.

Headers Worth Checking

• Location: where a 301, 302, 307 or 308 sends the browser. Long chains slow page loads, and a loop means the page never loads.
• Cache-Control, ETag, Last-Modified: how long browsers and CDNs may keep a copy. no-store on static files makes every visit download them again.
• Content-Type: a JSON API that returns text/html, or a CSS file served as text/plain, breaks clients.
• Strict-Transport-Security: tells browsers to use HTTPS only for a set time, for example max-age=31536000; includeSubDomains.
• Content-Security-Policy: limits where scripts, styles and frames can load from, which reduces XSS risk.
• X-Content-Type-Options: nosniff and Referrer-Policy: short, low-risk security headers most sites should send.
• Server, X-Powered-By, Via, CF-Cache-Status: reveal the web server, framework or CDN, and whether the CDN served a cached copy.

From the Command Line

curl -sIL https://example.com prints the headers for each hop. -I sends a HEAD request, which some servers answer differently from GET. Use curl -sL -D - -o /dev/null https://example.com to see GET headers.