HTTP Header Analyzer: Free Online Header Check

The HTTP header analyzer shows every response header a public URL returns, plus an audit of six key security headers. Enter a URL and you get the status code, the header count, the final URL after redirects, and a full table of header names and values. It is free and needs no sign-in.

What Are HTTP Headers?

HTTP headers are name and value pairs that a web server sends back with every page, image or file, telling the browser or crawler how to handle the content. They travel before the page body, so they work like a shipping label on a package.

Request headers go from the browser to the server (for example Accept, Host or Referer). Response headers go the other way, and those are what this tool shows. A typical response includes a status line such as 200 OK, then lines like Content-Type: text/html; charset=UTF-8 and Cache-Control: max-age=3600.

Why headers matter for SEO and security

Headers affect crawling, speed and safety. The status code and redirect behavior decide whether Google can index a URL, caching headers decide how often browsers re-download files, and security headers tell browsers which risky behaviors to block. Google's Search Central documentation also treats HTTP status codes and redirects as core crawl signals.

Are header names case sensitive?

No. Header names are case-insensitive, so Content-Type and content-type mean the same thing. HTTP/2 servers send names in lowercase, which is why you may see different capitalization on different sites. Header values can be case sensitive depending on the header, so copy them exactly.

How to Use the HTTP Header Analyzer

You can inspect a URL in under a minute by following these steps.

1. Type or paste the page address into the URL field. The hint says to enter the full URL including https://, and if you leave the protocol off, the tool assumes https://.
2. Press the Analyze Headers button. The button changes to "Analyzing..." while the request runs.
3. Check the summary line: Status (code and text), Headers (how many came back) and Final URL, which appears only when the address you entered ended up somewhere else.
4. Review the Security Headers Audit cards. Each of the six headers is marked as present, weak or not set.
5. Scroll to All Response Headers and read the Header Name and Value columns for everything else, including caching, content type, server and cookie headers.
6. Fix what you find on your server or CDN, then run the same URL again to confirm the change.

Worked Example: Reading One Result

Here is an illustrative result for a store page, so you can see how to turn raw headers into a to-do list. Say you enter shop.example.com.

• Status: 200 OK, Headers: 14, Final URL: https://www.shop.example.com/ (the tool followed a redirect).
• Strict-Transport-Security: present, max-age=31536000.
• Content-Security-Policy: weak, marked "Report-Only (not enforced)".
• X-Content-Type-Options: present, nosniff.
• X-Frame-Options: Not set.
• Referrer-Policy: present, strict-origin-when-cross-origin.
• Permissions-Policy: Not set.

What this tells you: the page loads fine, and the redirect to the www version works. HSTS is set for one year, which is a common choice. The policy for Content-Security-Policy is only reporting violations, so it blocks nothing yet. Two headers are missing. Your action list is to promote the CSP from report-only to enforced once the reports look clean, add a frame restriction, and add a Permissions-Policy that turns off browser features the site does not use, such as camera and microphone.

How Do You Read and Act on the Results?

Each part of the result answers a different question, and each has a clear fix when something looks wrong.

The status line

A 200 means the final page loaded. A 301 or 302 that the tool could not finish following, a 404 or a 5xx means the URL has a problem to fix before anything else matters. If Final URL differs from what you typed, the address redirects. Redirect chains waste crawl time, so link directly to the final address wherever you can.

The Security Headers Audit

The audit checks six headers and uses three states: present, weak (shown in amber) and Not set (shown in red). Long values are shortened on the card, and the full text is in the table below.

Treat these as widely used guidelines, not a legal checklist. A site can be safe without every header, and a header can be present but poorly configured.

The full header table

Use this table to check headers the audit does not score. Look for Cache-Control (how long browsers and CDNs may keep a copy), Content-Type (the right MIME type and charset), Content-Encoding (compression), Location (redirect target), Set-Cookie and Link. If you want a deeper look at compression, the GZIP compression checker shows what is active and the bytes saved.

Who Should Use This Tool and When?

Anyone who needs to see what a server says about a page, without opening browser developer tools, will find it useful.

• SEO specialists confirm status codes, redirect destinations and cache rules during a technical audit or after a migration.
• Developers verify that a deployment, CDN rule or proxy setting added the right headers, and learn how a header value is formatted.
• Site owners check security headers before a security review or after a hosting change.
• Content teams find out why an updated page still looks old, which is often a long Cache-Control lifetime.
• Learners compare headers from different sites to understand what Content-Type, Host, Accept or Referer actually look like in practice.

When you need the status of many addresses at once, use the bulk HTTP status code checker instead. To see which protocol version a site negotiates, try the HTTP/2 and HTTP/3 checker.

Best Practices, Mistakes and Troubleshooting

Most surprises come from testing the wrong URL or expecting the tool to see something it cannot. These checks save the most time.

• Test the exact URL users and crawlers reach. The homepage, a blog post and an image can each return different headers, so run the page type you care about.
• Test both versions. Run the http, https, www and non-www versions of your homepage, then read the Final URL to confirm they all resolve to one address.
• Do not stop at "present". A Strict-Transport-Security header with a tiny max-age or a Content-Security-Policy that allows everything passes the presence check but protects little.
• Switch CSP from report-only carefully. Collect violation reports first, fix legitimate blocked resources, then enforce. Enforcing too early can break scripts, fonts or embeds.
• Add headers where they are set. If a header you configured does not appear, a CDN, proxy or caching layer may be overriding it, or you may have changed the wrong server block.
• Watch for oversized headers. Many servers reject a request when headers exceed roughly 8 KB in total, usually because of large cookies. If you see 400 or 431 errors, trim cookie data.
• Typos in the URL. If you get a "valid URL" message, remove spaces and check the domain. A "not reachable as a public address" message means the URL is local, internal or otherwise not public.

Limitations to Keep in Mind

The analyzer reads the headers from the final response only, after following up to five redirects, so headers sent by earlier hops in a chain are not listed. Use the Final URL field to spot that a redirect happened, and check each hop separately if you need to debug one.

The audit covers six security headers and checks whether each is present, not whether the policy inside it is well designed. It works only on publicly reachable addresses, so staging sites behind a login or firewall cannot be inspected. Servers can also return different headers to different visitors, for example based on location, device or login state, so what you see here may not match every user. For a related view with a security score, see the HTTP header checker, and browse the website audit and performance tools for more technical checks.

Run your own page through the HTTP header analyzer above, note which security cards are amber or red, and fix them one at a time, re-testing after each change until your headers match what your site is meant to send.