An HTTP header checker that explains what each header does
This HTTP header checker shows every response header a web server sends for a URL — the same list you would get from curl -I or your browser’s developer tools — and explains each one in a sentence. If the address redirects, every hop is listed separately, so you can see which headers the redirect sends and which the final page sends.
Headers are grouped by purpose: security (CSP, HSTS, framing, CORS), cookies with their Secure, HttpOnly and SameSite flags, caching (Cache-Control, ETag, CDN hit or miss), content (type, compression, language) and server details. You can copy them as plain text or JSON, or compare two URLs side by side — staging against production, www against non-www, or a page before and after a configuration change.
How to use the HTTP Header Checker
- Enter a URL in the URL box. Without a scheme it is fetched over https://; type
http://to include the redirect to HTTPS. - Optionally tick Compare with a second URL and enter URL B.
- Press Check headers. The final hop opens automatically; earlier redirect hops are collapsed above it.
- Read each group. The grey line under every header says what it does; unfamiliar custom headers are marked as such.
- Use Copy as text for a ticket or chat, or Copy as JSON for a script.
HTTP Header Checker features
Every header, every hop
All response headers of each redirect hop (up to 10), with status code, time to headers and where the redirect points.
Grouped and explained
More than 60 common headers have a plain-English explanation; CDN cache headers, cloud request IDs and CORS headers are recognised by pattern.
Cookie flags at a glance
Each Set-Cookie line shows whether it is Secure, HttpOnly and SameSite. For a deeper look, paste it into the Cookie Decoder.
Compare two URLs
Final responses side by side: same, different, only in A or only in B, with per-request headers such as Date or a request ID kept apart from real differences.
Copy as text or JSON
One name: value per line, per hop, or structured JSON with status codes and header arrays.
Headers worth checking first
For a scored review of the security headers alone, with fixes for Nginx, Apache and Cloudflare, use the Security Header Checker. To trace only status codes for a list of URLs, the HTTP Status Checker is quicker.
| Header | What to look for |
|---|---|
| Cache-Control | HTML usually no-cache or a short max-age; versioned assets max-age=31536000, immutable |
| Content-Encoding | br or gzip on HTML, CSS and JavaScript |
| Vary | Accept-Encoding for compressed responses; Origin when CORS answers vary by site |
| Strict-Transport-Security | At least a year (max-age=31536000) once HTTPS works everywhere |
| Set-Cookie | Secure and SameSite on every cookie; HttpOnly on session cookies |
| Server / X-Powered-By | No version numbers — they only help attackers |
Worked example: http://example.com/
Checking http://example.com/ typically shows two hops. Hop 1 is a 301 Moved Permanently with a location: https://example.com/ header and a handful of server headers. Hop 2 is the HTTPS page with 200 OK. Its caching group might show cache-control: max-age=3600, age: 1520 and cf-cache-status: HIT — the copy came from a CDN cache and was 25 minutes old — while the content group shows content-encoding: br for Brotli compression.
Comparing https://example.com/ with https://www.example.com/ then highlights configuration drift: a different server, a security header present on only one host, and date marked as a per-request difference rather than a real one.
Why the headers can differ from your browser’s
The request is made from a server on Cloudflare’s network with a neutral user agent, no cookies and no login, and the body is never downloaded. Sites can vary headers by country, device, language or login state, and some block data-centre traffic with 403 or 429 answers. Only public addresses on ports 80 and 443 can be checked, values longer than 2,000 characters are shortened, and each network may run 120 checks every 10 minutes.
HTTP Header Checker FAQ
How do I check the HTTP headers of a website?
Enter the URL in the HTTP header checker and press Check headers. Every response header is listed with its value and a short explanation, hop by hop if the address redirects.
Is this the same as curl -I?
Close. curl -I sends a HEAD request and shows one response; this tool sends a GET, follows redirects by hand and lists the headers of each hop, without downloading the page body.
Why are some headers missing that I see in my browser?
Browsers send cookies, a login and their own language and device hints, and some servers answer differently. Headers added by browser extensions or service workers never come from the server at all.
What does cf-cache-status or x-cache mean?
They come from a CDN. HIT means a cached copy answered; MISS, EXPIRED or DYNAMIC mean the CDN had to ask your server. Age shows how many seconds a cached copy has been stored.
Can I see request headers too?
No — only response headers. The checker sends a minimal request with a generic user agent and no cookies, so there is nothing personal to show.
Is the HTTP header checker free?
Yes, with no sign-up. Each network can make up to 120 checks every 10 minutes.