Get HTTP Headers Online - Free Header Viewer

Use this tool to get HTTP headers for any public URL in one step. Enter a web address and you see the status code, every response header as a name and value pair, a raw view you can copy, and a check for six common security headers. It helps developers, SEOs and site owners debug servers, caching and redirects.

What Are HTTP Headers?

HTTP headers are name and value pairs that a web server sends back before the page content, telling the browser or crawler how to treat the response. A line such as Content-Type: text/html; charset=UTF-8 says what kind of file is coming and how to decode it.

Every response starts with a status line, for example HTTP/1.1 200 OK, followed by the headers. Headers cover many jobs:

• Status and redirects: the status code and the Location header that says where a moved page now lives.
• Caching: Cache-Control, ETag, Expires and Last-Modified decide how long browsers and CDNs may reuse a file.
• Content details: Content-Type, Content-Encoding and Content-Length.
• Security: Strict-Transport-Security, Content-Security-Policy and similar rules the browser enforces.
• Crawling signals: X-Robots-Tag and a Link header with a canonical URL.

This page shows response headers, which are what a server sends back. Request headers are what a browser or script sends to the server, and you set those in your own code.

How to Use the HTTP Header Checker

You can read a site's headers in four quick steps, and the whole process takes a few seconds.

1. Type or paste a URL into the box, for example https://example.com. If you leave off the protocol, https:// is added for you.
2. Submit the form and wait for the result page to load.
3. Check the summary at the top: the status line, the number of headers, the security score and the status code.
4. Type a word such as cache or server into Filter headers... to narrow the table, or select Toggle raw view to see the unedited header text.
5. Select Copy All to copy the full raw header block for a ticket, a log or a message to your developer.

The filter works on the table view only. In raw view the filter is switched off and the tool tells you it is showing all headers.

Worked Example: Reading the Headers of a Moved Page

Say you enter http://example.com/old-page after a site migration. The result might look like this (illustrative values):

• Status line: HTTP/1.1 301 Moved Permanently, shown with a blue badge because it is in the 300 range.
• Header count: 9.
• Location: https://www.example.com/new-page.
• Security: 2/6, with only HSTS and X-Content-Type-Options found.

The 301 tells you the old URL is permanently redirected, and the Location header confirms the destination is the one you intended. The security score is 2 divided by 6, or 33%, which falls in the red band. That does not break the redirect, but it tells you four protective headers are missing and worth adding on the destination site.

If the Location value had pointed to the wrong page, you would fix the redirect rule at the server or CDN level and run the check again.

How Do You Read the Results?

The results page is split into a summary, a security checklist and the full header list, and each part answers a different question.

Status code badge

The badge color follows the code range. Green means 2xx (success), blue means 3xx (redirect), amber means 4xx (client error such as 404 or 403), and red means a server error or anything else. For indexable pages, you normally want a 200. A page that should rank but returns 404, 410 or 5xx will not be kept in search results. Google's Search Central documentation explains how it handles each class of status code.

Security score

The tool looks for six headers and reports how many are present as a fraction and a percentage:

A score of 70% or more shows green, which in practice means five or six of the six headers. From 40% to 69% shows amber (three or four headers), and below 40% shows red. The score counts presence only, so it does not judge whether a value is strong or well written.

Common values to look for

• Strict-Transport-Security: max-age=31536000 is a widely used one-year HSTS setting.
• X-Content-Type-Options: nosniff is the standard value.
• X-Frame-Options is usually DENY or SAMEORIGIN.
• Cache-Control: public, max-age=31536000 suits fingerprinted static files, while HTML pages often use shorter lifetimes or revalidation.
• X-Robots-Tag: noindex on a page you want ranked is a red flag.

Who Needs to Get HTTP Headers?

Anyone who needs to see what a server really sends, instead of guessing from the page, benefits from a header check.

• SEOs confirm that a redirect is a 301 and not a 302, spot a stray X-Robots-Tag, and verify canonical Link headers on PDFs and other non-HTML files.
• Developers check content types, caching rules and CORS-related headers without opening browser DevTools or writing a script.
• Site owners review security headers before an audit or after changing hosting.
• Agencies copy the raw output into a client report or support ticket.
• Learners studying the meaning of HTTP headers can look at real examples from sites they know.

For a broader view, the HTTP header analyzer goes deeper on caching and server details. When you need status codes for many URLs after a migration, the bulk HTTP status checker handles up to 100 at a time.

Best Practices and Troubleshooting

A few habits make header checks more reliable and save time when something looks off.

Check the exact URL that matters

Headers can differ between the home page, an image, a PDF and a redirected URL. Test the specific address you care about, including the right version (http or https, with or without www).

Fix an error or empty result

• Typos: a misspelled domain or a space in the URL cannot be resolved. Re-enter it and try again.
• Private pages: a staging site behind a login, a firewall or an IP allowlist cannot be reached from outside, so the check fails.
• Server down: if the site itself is offline, there are no headers to show.

Compare after every change

After you edit server rules, a CDN setting or a security plugin, run the check again and compare the header count and security fraction with the previous result. Use Copy All to keep a before and after record.

Pair headers with related checks

Headers show whether compression is announced through Content-Encoding, but the GZIP compression checker tests it directly. To see which protocol version a site negotiates, use the HTTP/2 and HTTP/3 checker. If a page returns a clean 200 but still is not showing in search, the Google index checker is a sensible next step.

Limitations to Keep in Mind

The tool reports what the server returned to this single request, so treat it as a snapshot. A CDN, load balancer or bot-protection layer may send different headers to different visitors, locations or user agents. Some servers also answer a header-only request slightly differently from a full page load.

The security score checks whether each of six headers exists. It does not validate policy syntax, grade the strength of a Content-Security-Policy, or cover every header that matters, such as cookie flags. Use it as a quick screen, then review important values by hand.

The tool also covers one URL per check and shows response headers only. It does not show the request headers your browser or code sends.

Start Reading Your Headers

A quick header check tells you the real status code, caching rules, redirect target and security setup of any public page. Enter your URL in the box above, filter the table for the header you care about, and copy the raw output when you need to share it. For more checks on speed and site health, browse the Website Audit and Performance tools.