HTTP Headers Checker

See the HTTP status code, full redirect chain and response headers for any URL, and get a security headers grade with fixes.

Try: http://github.com, wikipedia.org, example.com

Redirect chain

2 requests
#StatusURLTime
1 301 Moved Permanently https://bbc.co.uk 134 ms
2 200 OK https://www.bbc.co.uk/ 233 ms

Security headers

6/6A
  • Strict-Transport-Security: max-age=31536000; preload
    Forces browsers to use HTTPS for future visits (HSTS).
  • Content-Security-Policy: default-src 'none'; script-src 'strict-dynamic' 'nonce-NjVSBONkq+iai+pbG1XiyjDIThQ3lhPkV74Wi2gDPcc0QO3Jug' 'self' 'report-sample' 'unsafe-inline' cdn.syndicati…
    Restricts which scripts, styles and frames can load; the strongest defence against XSS.
  • X-Content-Type-Options: nosniff
    Set to 'nosniff' to stop browsers guessing content types.
  • X-Frame-Options: DENY
    Prevents clickjacking by controlling who can frame the page (or use CSP frame-ancestors).
  • Referrer-Policy: strict-origin-when-cross-origin
    Controls how much of the URL is sent to other sites in the Referer header.
  • Permissions-Policy: browsing-topics=(), join-ad-interest-group=(), run-ad-auction=()
    Turns off powerful browser features (camera, geolocation...) the site does not use.
HTTP/3: Advertised h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 · Server: BBC-GTM

Response headers

https://www.bbc.co.uk/ · 146.75.28.81
Connectionkeep-alive
Content-Length83446
Content-Typetext/html
belfrage-cache-statusMISS
bidbruce
brequestid8a006f490a874477922517e8582d6d2d
bsig1208f4af15d5afde4f19a9ad56d6a2c7
content-encodinggzip
content-security-policydefault-src 'none'; script-src 'strict-dynamic' 'nonce-NjVSBONkq+iai+pbG1XiyjDIThQ3lhPkV74Wi2gDPcc0QO3Jug' 'self' 'report-sample' 'unsafe-inline' cdn.syndication.twimg.com connect.facebook.net c.files.bbci.co.uk emp.bbci.co.uk mybbc-analytics.files.bbci.co.uk nav.files.bbci.co.uk news.files.bbci.co.uk platform.twitter.com public.flourish.studio static.bbc.co.uk static.bbci.co.uk static.chartbeat.com static2.chartbeat.com www.bbc.co.uk www.instagram.com www.ons.gov.uk gn-web-assets.api.bbc.com www.google-analytics.com bitesize.files.bbci.co.uk www.tiktok.com lf16-tiktok-web.ttwstatic.com static.files.bbci.co.uk; img-src 'self' https: data:; font-src c.files.bbci.co.uk gel.files.bbci.co.uk static.files.bbci.co.uk static.bbci.co.uk news.files.bbci.co.uk ws-downloads.files.bbci.co.uk bitesize.files.bbci.co.uk; style-src branding.files.bbci.co.uk cdn.riddle.com flo.uri.sh news.files.bbci.co.uk platform.twitter.com static.bbc.co.uk static.bbci.co.uk static.files.bbci.co.uk ton.twimg.com www.riddle.com 'unsafe-inline' lf16-tiktok-web.ttwstatic.com; frame-src 'self' bbc001.carto.com bbc003.carto.com bbc-maps.carto.com *.cdn.optimizely.com cdn.riddle.com chartbeat.com emp.bbc.co.uk emp.bbc.com flo.uri.sh graphics.reuters.com interactives.apelections.org www.reuters.com graphics.thomsonreuters.com dynamic.mc-cdn.io vapi.mc-cdn.io vapi.beta.mc-cdn.io elections.mapcreator.io elections.beta.mapcreator.io cdn.mapcreator.io m.facebook.com news.files.bbci.co.uk personaltaxcalculator2.deloittecloud.co.uk platform.twitter.com public.flourish.studio static2.chartbeat.com syndication.twitter.com web.facebook.com www.bbc.co.uk www.facebook.com www.instagram.com www.tiktok.com www.ons.gov.uk www.riddle.com www.youtube.com www.youtube-nocookie.com uk-script.dotmetrics.net ssp-app-uk.votenow.tv ssp-app-uktest.votenow.tv ssp-app-ukbench.votenow.tv session.test.bbc.co.uk session.bbc.co.uk session.stage.bbc.co.uk bitesize.files.bbci.co.uk; object-src 'none'; manifest-src static.files.bbci.co.uk bitesize.files.bbci.co.uk; media-src 'self' blob: https:; connect-src 'self' https:; child-src blob:; base-uri 'none'; form-action 'self' platform.twitter.com syndication.twitter.com uk-script.dotmetrics.net/DeviceInfo.dotmetrics account.bbc.com/auth/identifier/landing; frame-ancestors 'none'; upgrade-insecure-requests; report-to default; report-uri https://webcore.bbc-reporting-api.app/report-endpoint;
feature-policyaccelerometer 'none'; autoplay 'self' https://emp.bbc.com https://emp.bbc.co.uk http://emp.bbc.com http://emp.bbc.co.uk; camera 'none'; document-domain 'self' https://emp.bbc.com https://emp.bbc.co.uk http://emp.bbc.com http://emp.bbc.co.uk; encrypted-media 'none'; fullscreen 'self' https://emp.bbc.com https://emp.bbc.co.uk http://emp.bbc.com http://emp.bbc.co.uk; geolocation 'self'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture 'self' https://emp.bbc.com https://emp.bbc.co.uk http://emp.bbc.com http://emp.bbc.co.uk; screen-wake-lock 'none'; sync-xhr 'self'; usb 'none'; xr-spatial-tracking 'none'
nel{"report_to":"default","max_age":2592000,"include_subdomains":true,"failure_fraction":0.25}
permissions-policyaccelerometer=(), autoplay=(self "https://emp.bbc.com" "https://emp.bbc.co.uk" "http://emp.bbc.com" "http://emp.bbc.co.uk"), camera=(), document-domain=(self "https://emp.bbc.com" "https://emp.bbc.co.uk" "http://emp.bbc.com" "http://emp.bbc.co.uk"), encrypted-media=(), fullscreen=(self "https://emp.bbc.com" "https://emp.bbc.co.uk" "http://emp.bbc.com" "http://emp.bbc.co.uk"), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(self "https://emp.bbc.com" "https://emp.bbc.co.uk" "http://emp.bbc.com" "http://emp.bbc.co.uk"), screen-wake-lock=(), sync-xhr=(self), usb=(), xr-spatial-tracking=()
permissions-policybrowsing-topics=(), join-ad-interest-group=(), run-ad-auction=()
referrer-policystrict-origin-when-cross-origin
req-svc-chainFASTLY,GTM,BELFRAGE,WEBCORE
via1.1 BBC-GTM, 1.1 Belfrage, 1.1 varnish
x-content-type-optionsnosniff
x-frame-optionsDENY
x-xss-protection1; mode=block
Origin-Agent-Cluster?0
X-BBC-Edge-Cache-StatusSTALE
report-to{"group":"default","max_age":2592000,"endpoints":[{"url":"https://default.bbc-reporting-api.app/report-endpoint","priority":1}],"include_subdomains":true}
ServerBBC-GTM
Strict-Transport-Securitymax-age=31536000; preload
X-Robots-Tagbingbot: noarchive
Fastly-Restarts1
Accept-Rangesbytes
DateTue, 13 Oct 2026 17:48:46 GMT
X-Fastly-Cache-StatusHIT-STALE-CLUSTER
X-Served-Bycache-iad-kiad7000174-IAD
X-CacheHIT
X-Cache-Hits1
X-TimerS1791913727.654720,VS0,VE37
X-Fastly-Pre-Flight-CacheMISS, MISS
X-Fastly-Pre-Flight-Cache-StatusMISS-CLUSTER
X-cache-age6
X-LB-NoCachetrue
Cache-Controlprivate, stale-if-error=90, stale-while-revalidate=30, max-age=0, must-revalidate
VaryX-BBC-Edge-Scheme,x-id-oidc-signedin,Accept-Encoding
alt-svch3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400

What this HTTP header checker shows

Enter any URL and we request it from our server exactly as a browser would, without following redirects automatically. That lets us show you every hop in the redirect chain with its status code and response time, followed by the full response headers of the final page and a security headers grade.

HTTP status codes cheat sheet

CodeMeaningSEO note
200 OKThe page loaded normally.Indexable.
301 Moved PermanentlyPermanent redirect.Passes ranking signals; use for domain moves and HTTP→HTTPS.
302 / 307 Temporary redirectTemporary move.Search engines keep the original URL indexed.
308 Permanent RedirectLike 301 but keeps the request method.Treated like 301.
304 Not ModifiedCached copy is still valid.Normal for repeat visits.
403 ForbiddenAccess denied, often a firewall or bot protection.Can block crawlers.
404 Not FoundNo page at this URL.Drops out of the index over time.
410 GoneRemoved on purpose.Removed from the index faster than 404.
500 / 502 / 503Server or upstream error.Persistent 5xx errors hurt crawling.

Redirect best practices

  • Keep chains to one hop: http://example.com should go straight to https://www.example.com/, not via two or three intermediate URLs.
  • Use 301 or 308 for permanent moves, so search engines transfer ranking signals.
  • Avoid redirect loops and mixed HTTPS→HTTP hops.

Recommended security headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Add HSTS only once every subdomain supports HTTPS, and roll out CSP in Content-Security-Policy-Report-Only mode first. Check the TLS side with our SSL checker.

Frequently asked questions

Why do I see a 403 when the site works in my browser?

Some sites block automated requests or requests from cloud data centres with bot protection.

Which ports can I check?

Ports 80, 443, 8080 and 8443 on public addresses. Private and internal addresses are blocked for security.

Copied to clipboard