HTTP Headers Checker

See the HTTP status code, full redirect chain and response headers for any URL, and get a security headers grade with fixes.

Try: http://github.com, wikipedia.org, example.com

Redirect chain

2 requests
#StatusURLTime
1 301 Moved Permanently https://cloudflare.com 292 ms
2 200 OK https://www.cloudflare.com/ 224 ms

Security headers

6/6A
  • Strict-Transport-Security: max-age=31536000; includeSubDomains
    Forces browsers to use HTTPS for future visits (HSTS).
  • Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflareinsights.com https://static-staging.cloudflareinsights.com https:/…
    Restricts which scripts, styles and frames can load; the strongest defence against XSS.
  • X-Content-Type-Options: nosniff
    Set to 'nosniff' to stop browsers guessing content types.
  • X-Frame-Options: SAMEORIGIN
    Prevents clickjacking by controlling who can frame the page (or use CSP frame-ancestors).
  • Referrer-Policy: strict-origin-when-cross-origin
    Controls how much of the URL is sent to other sites in the Referer header.
  • Permissions-Policy: geolocation=(), camera=(), microphone=()
    Turns off powerful browser features (camera, geolocation...) the site does not use.
HTTP/3: Advertised h3=":443"; ma=86400 · Server: cloudflare

Response headers

https://www.cloudflare.com/ · 104.16.123.96
DateTue, 13 Oct 2026 06:43:47 GMT
Content-Typetext/html; charset=utf-8
Transfer-Encodingchunked
Connectionkeep-alive
Link<https://www.cloudflare.com/.well-known/api-catalog>; rel="api-catalog", <https://www.cloudflare.com/.well-known/agents.json>; rel="service-desc", <https://www.cloudflare.com/.well-known/webmcp.json>; rel="service-desc", <https://www.cloudflare.com/openapi.json>; rel="service-desc", <https://www.cloudflare.com/llms.txt>; rel="service-doc", <https://www.cloudflare.com/sitemap.xml>; rel="sitemap", </fonts/Kunst%20Grotesk%20Regular.woff2>; rel=preload; as=font; type="font/woff2"; crossorigin, </fonts/Kunst%20Grotesk%20Medium.woff2>; rel=preload; as=font; type="font/woff2"; crossorigin, <https://ot.www.cloudflare.com>; rel=preconnect; crossorigin, <https://imagedelivery.net>; rel=preconnect; crossorigin, </static/hero-poster.avif>; rel=preload; as=image; type="image/avif"; fetchpriority=high
CF-Raya49c5f3afb5982a4-IAD
CF-Cache-StatusHIT
Nel{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Age9
Cache-Controlmax-age=10
Servercloudflare
Varyaccept-encoding
Strict-Transport-Securitymax-age=31536000; includeSubDomains
Content-Security-Policydefault-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflareinsights.com https://static-staging.cloudflareinsights.com https://challenges.cloudflare.com https://*.onetrust.com https://cdn.cookielaw.org https://ot.www.cloudflare.com https://www.googletagmanager.com https://tagmanager.google.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://adservice.google.com https://cdn.bizible.com https://js.adsrvr.org https://*.marketo.net https://platform.twitter.com https://static.ads-twitter.com https://scripts.demandbase.com https://tag.demandbase.com https://*.6sc.co https://*.qualified.com https://snap.licdn.com https://bat.bing.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://*.googletagmanager.com https://*.google-analytics.com https://*.google.com https://*.doubleclick.net https://www.googleadservices.com https://translate.googleapis.com https://cdn.bizible.com https://js.adsrvr.org https://*.marketo.net https://ads-twitter.com https://analytics.twitter.com https://*.twimg.com https://api.demandbase.com https://scripts.demandbase.com https://tag.demandbase.com https://tag-logger.demandbase.com https://api.company-target.com https://*.6sc.co https://epsilon.6sense.com https://*.qualified.com https://*.ads.linkedin.com https://www.linkedin.com https://bat.bing.com https: wss://*.qualified.com wss://*.registrar.cloudflare.com; frame-src https://*.adsrvr.org https://*.cloudflare.com https://*.videodelivery.net https://*.cloudflarestream.com https://www.googletagmanager.com https://*.qualified.com https://td.doubleclick.net https://bid.g.doubleclick.net https://9309168.fls.doubleclick.net https://9973066.fls.doubleclick.net https://s.company-target.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' blob:; child-src 'self' blob:; upgrade-insecure-requests
Cross-Origin-Opener-Policyunsafe-none
Cross-Origin-Resource-Policycross-origin
Permissions-Policygeolocation=(), camera=(), microphone=()
Referrer-Policystrict-origin-when-cross-origin
X-Content-Type-Optionsnosniff
X-Frame-OptionsSAMEORIGIN
X-Served-Bymarketing-site
X-XSS-Protection1; mode=block
x-RMGW
Set-Cookie_ga=GA1.1.eabc4450-7e68-4670-b469-3dd90cf3462e; Expires=Sat, 13 Nov 2027 06:43:47 GMT; Path=/
Set-Cookiecfz_google-analytics_v4={"nzcr_ga4":{"v":"eabc4450-7e68-4670-b469-3dd90cf3462e","e":1826088227053}}; Expires=Sat Nov 13 2027 06:43:47 GMT+0000 (Coordinated Universal Time); HttpOnly; SameSite=Lax; Path=/; Secure
Set-Cookiecfz_adobe={"MsVJ_ecid":{"v":"CiY4NjI0MjAxNDA0NTYwNjM5MTk3MjYzNDYzODU2NTUzMDI2OTQxMlIOCPiBg6CTNCoDVkE2MALwAfiBg6CTNA==","e":1826001827065}}; Expires=Fri Nov 12 2027 06:43:47 GMT+0000 (Coordinated Universal Time); HttpOnly; SameSite=Lax; Path=/; Secure
Set-Cookiekndctr_8AD56F28618A50850A495FB6_AdobeOrg_identity=CiY4NjI0MjAxNDA0NTYwNjM5MTk3MjYzNDYzODU2NTUzMDI2OTQxMlIOCPiBg6CTNCoDVkE2MALwAfiBg6CTNA==; Expires=Fri, 12 Nov 2027 06:43:47 GMT; Path=/; Secure; SameSite=Lax
Set-Cookie__cf_bm=8u6vAnymldw6f9QkjS9p3qdbClM0RqCe3cZIfV5BuCg-1791873827.03906-1.0.1.1-EHWiYpRu8gGPrKr.SCjdnAc4F24b9I93mnXyaJCAQ2BQaeoyMeCB1ALC9HmDjm_Vjp0mxRF8YYRpLFpIX_CdOpo4JrCt6fFNl2q3krObnHSMJzcKZIadvTALrGOw.oy.U7lRQUEA.rImL96C7cPDfw; HttpOnly; SameSite=None; Secure; Path=/; Domain=www.cloudflare.com; Expires=Tue, 13 Oct 2026 07:13:47 GMT
Server-TimingcfCacheStatus;desc="HIT"
Server-TimingcfEdge;dur=20,cfOrigin;dur=0,cfWorker;dur=21
Report-To{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=N9o%2BSpeyg8ej2xx3JpiXXnNocq4QfU%2FLRUdf2F39tmlo%2BpXa71VQt3n%2BXvh6IwKsNxglTgZZoyn00fzoXBFRCfVIJz5QxDpH5ywFgJSCB0HmfZ3pZAQUqhTeZfTDNO6L7Dr1Xw%3D%3D"}]}
Content-Encodingbr
alt-svch3=":443"; ma=86400

What this HTTP header checker shows

Enter any URL and we request it from our server exactly as a browser would, without following redirects automatically. That lets us show you every hop in the redirect chain with its status code and response time, followed by the full response headers of the final page and a security headers grade.

HTTP status codes cheat sheet

CodeMeaningSEO note
200 OKThe page loaded normally.Indexable.
301 Moved PermanentlyPermanent redirect.Passes ranking signals; use for domain moves and HTTP→HTTPS.
302 / 307 Temporary redirectTemporary move.Search engines keep the original URL indexed.
308 Permanent RedirectLike 301 but keeps the request method.Treated like 301.
304 Not ModifiedCached copy is still valid.Normal for repeat visits.
403 ForbiddenAccess denied, often a firewall or bot protection.Can block crawlers.
404 Not FoundNo page at this URL.Drops out of the index over time.
410 GoneRemoved on purpose.Removed from the index faster than 404.
500 / 502 / 503Server or upstream error.Persistent 5xx errors hurt crawling.

Redirect best practices

  • Keep chains to one hop: http://example.com should go straight to https://www.example.com/, not via two or three intermediate URLs.
  • Use 301 or 308 for permanent moves, so search engines transfer ranking signals.
  • Avoid redirect loops and mixed HTTPS→HTTP hops.

Recommended security headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Add HSTS only once every subdomain supports HTTPS, and roll out CSP in Content-Security-Policy-Report-Only mode first. Check the TLS side with our SSL checker.

Frequently asked questions

Why do I see a 403 when the site works in my browser?

Some sites block automated requests or requests from cloud data centres with bot protection.

Which ports can I check?

Ports 80, 443, 8080 and 8443 on public addresses. Private and internal addresses are blocked for security.

Copied to clipboard