What this HTTP header checker shows
Enter any URL and we request it from our server exactly as a browser would, without following redirects automatically. That lets us show you every hop in the redirect chain with its status code and response time, followed by the full response headers of the final page and a security headers grade.
HTTP status codes cheat sheet
| Code | Meaning | SEO note |
|---|---|---|
| 200 OK | The page loaded normally. | Indexable. |
| 301 Moved Permanently | Permanent redirect. | Passes ranking signals; use for domain moves and HTTP→HTTPS. |
| 302 / 307 Temporary redirect | Temporary move. | Search engines keep the original URL indexed. |
| 308 Permanent Redirect | Like 301 but keeps the request method. | Treated like 301. |
| 304 Not Modified | Cached copy is still valid. | Normal for repeat visits. |
| 403 Forbidden | Access denied, often a firewall or bot protection. | Can block crawlers. |
| 404 Not Found | No page at this URL. | Drops out of the index over time. |
| 410 Gone | Removed on purpose. | Removed from the index faster than 404. |
| 500 / 502 / 503 | Server or upstream error. | Persistent 5xx errors hurt crawling. |
Redirect best practices
- Keep chains to one hop:
http://example.comshould go straight tohttps://www.example.com/, not via two or three intermediate URLs. - Use 301 or 308 for permanent moves, so search engines transfer ranking signals.
- Avoid redirect loops and mixed HTTPS→HTTP hops.
Recommended security headers
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()Add HSTS only once every subdomain supports HTTPS, and roll out CSP in Content-Security-Policy-Report-Only mode first. Check the TLS side with our SSL checker.
Frequently asked questions
Why do I see a 403 when the site works in my browser?
Some sites block automated requests or requests from cloud data centres with bot protection.
Which ports can I check?
Ports 80, 443, 8080 and 8443 on public addresses. Private and internal addresses are blocked for security.