What do the most common HTTP status codes mean?

2xx codes indicate success. 3xx codes are redirects: 301 is permanent, 302 is temporary. 4xx codes are client errors: 404 means not found, 403 means forbidden. 5xx codes are server errors: 500 is a generic internal error, 503 means service unavailable.

What do the most common HTTP status codes mean?

2xx codes indicate success. 3xx codes are redirects: 301 is permanent, 302 is temporary. 4xx codes are client errors: 404 means not found, 403 means forbidden. 5xx codes are server errors: 500 is a generic internal error, 503 means service unavailable.

HTTP Headers Checker

Q: What are HTTP response headers and why do they matter?

HTTP response headers are invisible key-value metadata sent by a server before the response body. They govern caching strategy, security policies, redirect destinations, content encoding, cookie behaviour and more.

Q: What is the difference between HEAD and GET requests?

A HEAD request retrieves headers only with no response body. It is faster, uses less bandwidth, and is ideal for checking headers without downloading a full page. Switch to GET only if a server returns different headers for GET versus HEAD.

View every HTTP response header for any URL — status code, security grade, caching, CDN detection, redirects and more. Free, no sign-up needed.

Enter any domain or full URL — HEAD fetches headers only (faster); GET includes the response body.

Enter a URL to inspect its HTTP response headers

Type any domain or full URL above and click Check to see every response header, security grade, caching details, CDN detection and status code explanation.

Requests made server-side

Results not cached or stored

No sign-up needed

Unlimited free checks

What This Tool Does

This checker makes a live HTTP request from our servers to any URL you specify and returns every response header the server sends back. Because the request originates from our infrastructure, the result reflects exactly what the public internet sees — independent of your browser cache, local network, or VPN. The tool simultaneously runs a security analysis grading seven critical security headers and surfaces caching, CDN and redirect details in a structured panel.

Security Header Grade

Checks seven security headers and grades A–F, with a plain-English explanation of what each one does and what is missing.

All Response Headers

Every header the server returns is listed in a filterable table, with security headers highlighted for quick identification.

Status Code Explanation

The HTTP status code is shown with a plain-English description and colour-coded banner so you know immediately what it means.

Caching & CDN Detection

Cache-Control, ETag, Last-Modified and CDN presence (Cloudflare, CloudFront, Varnish) are surfaced in the Connection Details panel.

How to Add Missing Security Headers

Apache — add Header always set directives to your .htaccess file or virtual host configuration and restart Apache.
Nginx — use add_header directives inside your server or location blocks, then reload Nginx.
Cloudflare — use Transform Rules → Modify Response Header to inject headers at the edge without touching your server.
HSTS safety — only enable HSTS after confirming with our SSL Checker that your certificate is valid, trusted and has ample time before expiry. A premature HSTS header with a lapsed certificate locks users out with no easy recovery.
CSP testing — deploy Content-Security-Policy-Report-Only first to collect violations without breaking anything, then switch to the enforcing header once stable.
After any configuration change, re-run this checker to confirm every header is present, then verify your certificate with our SSL Checker.

Frequently Asked Questions

What are HTTP response headers and why do they matter?

Every HTTP response consists of two parts: the body (HTML, JSON, images, files) and the headers — invisible key-value metadata sent before the body. Headers govern caching strategy, content encoding, security policies, redirect destinations, cookie behaviour, and more. Without inspecting headers directly you cannot fully understand how a server behaves, whether it is correctly protecting users, or why caching is not working as expected.

Headers are particularly important for security: the absence of a single header like Strict-Transport-Security can leave users exposed to downgrade attacks even when a valid HTTPS certificate is in place. Use our SSL Checker alongside this tool to cover both the certificate layer and the header layer in a complete HTTPS configuration audit.

What is the difference between HEAD and GET requests?

A HEAD request retrieves headers only — no response body is returned by the server. It is faster, uses less bandwidth, and is ideal for checking headers without downloading a full page or API response. Most well-behaved servers return identical headers for both HEAD and GET on the same URL, making HEAD the right choice for header inspection in the vast majority of cases.

Switch to GET only if a server is known to return different headers for GET versus HEAD — this is uncommon but does occur with some load balancers and legacy applications — or if you need to inspect content-negotiation headers that vary with the body. To verify whether a server port is accepting connections before sending any request, use our Port Checker.

How does the security header grade work?

The tool checks seven security-critical response headers and awards a letter grade from A (80% or more present) down to F (under 20%). Each header targets a specific attack class. HSTS prevents protocol downgrade attacks by forcing browsers to connect exclusively over HTTPS. Content-Security-Policy is the primary defence against cross-site scripting. X-Frame-Options blocks clickjacking by preventing your page from being loaded in an iframe on another domain.

X-Content-Type-Options: nosniff prevents MIME confusion attacks. Referrer-Policy limits how much URL data is leaked when users follow outbound links. Permissions-Policy restricts which browser APIs embedded content can access. X-XSS-Protection provides a legacy fallback filter for browsers that do not support CSP.

What do HTTP status codes mean?

Codes in the 2xx range indicate success — 200 OK is the standard response for a successful page load; 204 No Content means the server processed the request but has nothing to return. 3xx codes are redirects: 301 Moved Permanently passes SEO equity to the destination; 302 Found is temporary and does not. 307 and 308 are the method-preserving equivalents of 302 and 301 respectively.

4xx codes are client errors: 404 means the resource was not found; 403 means access is forbidden; 401 means authentication is required; 429 means rate limiting is active. 5xx codes are server errors: 500 is a generic internal error; 503 means the service is temporarily unavailable; 502 and 504 typically indicate a problem between a reverse proxy and the backend. When a redirect is detected this tool links directly to the destination so you can check its headers in one click.

How do caching headers work and how do I read them?

Cache-Control is the primary caching directive. Common values: max-age=3600 allows caching for one hour; no-cache requires revalidation with the server on each use but does not prevent caching entirely; no-store prevents any caching whatsoever; public allows CDN caching; private restricts caching to the browser only. stale-while-revalidate allows a stale cached response to be served while a fresh copy is fetched in the background.

ETag provides a fingerprint of the resource — if it matches the browser's cached version the server returns 304 Not Modified with no body, saving bandwidth. Last-Modified serves the same purpose using a timestamp. If you see unexpected caching behaviour, use our DNS Lookup to check whether a CDN is involved.

What does HSTS do and how do I enable it safely?

HTTP Strict Transport Security (HSTS) instructs browsers to connect exclusively over HTTPS for a specified duration, set via the max-age directive in seconds. Once a browser receives the header, it refuses any plain HTTP connection to that domain for the entire duration — even if the user manually types http://. This eliminates man-in-the-middle attacks that exploit the initial unencrypted request before a redirect to HTTPS.

Enable HSTS only after confirming with our SSL Checker that your certificate is valid, trusted by all major browsers, covers all subdomains you intend to protect, and has substantial time before expiry. Start with a short max-age such as 300 seconds, verify everything works, and increase to 31536000 (one year) once stable. The preload directive submits the domain to browser preload lists, which is largely irreversible — add it only when fully confident.

How do I detect which CDN is serving a domain?

This tool detects CDN presence automatically and shows it in the Connection Details panel. When Cloudflare proxies a domain, every response includes a CF-Ray header. Amazon CloudFront and Varnish appear in the Via header. Other proxies and CDNs also commonly identify themselves via Via or proprietary headers.

For deeper routing analysis, use our ASN Lookup to identify the autonomous system operating the server IP, our Reverse DNS to check the PTR record, and our DNS Lookup to verify the domain's A record is pointing to the CDN rather than an origin IP.

Can I check headers on APIs, subdomains and non-standard ports?

Yes — enter any fully qualified URL including subdomains, paths, query strings and non-standard ports. For example: https://api.example.com:8443/health or https://staging.example.com/status. The tool uses the full URL as entered without modification.

If a connection fails on a non-standard port, confirm the port is open using our Port Checker. For basic host reachability use our Ping Test, and verify DNS is resolving correctly with our DNS Lookup.

Is this HTTP headers checker storing my queries?

No. Requests are made live from our servers at the moment you submit the form — there is no caching of results, no database write for query data, and no account required. The URL you enter is used solely to make the live HTTP request and display the results back to you.

Standard web server access logs record each page request for security and uptime monitoring. These logs are periodically rotated and are not used for user tracking or advertising. For a complete domain health audit, combine this with our SSL Checker, DNS Lookup, WHOIS Lookup, Port Checker, Reverse DNS and ASN Lookup — all free and real-time with no sign-up.