Cache behavior
Review headers such as cache-control, expires, age, etag and CDN-specific fields to understand how a response may be cached.
HTTP Header Checker
Inspect response headers, status code, IP address and timing for a public URL.
Result
Inspect the response headers a public URL actually returns
The HTTP Header Checker makes a server-side request to the public URL you enter and returns the response status, resolved IP, response timing and headers received from the endpoint. It is useful for debugging caching, redirects, content types, CDN behavior and browser security policies.
Redirects and routing
A 3xx status plus a location header identifies a redirect destination. Proxy and CDN headers can also provide clues about which edge or upstream handled the request.
Content metadata
content-type, content-length, compression and language-related headers describe the returned representation and can expose incorrect server configuration.
Security policies
Headers such as HSTS, Content-Security-Policy, X-Content-Type-Options and Referrer-Policy influence browser security behavior when they are present and correctly configured.
Headers worth checking
content-type should match the resource being served. cache-control describes caching directives for browsers and intermediaries. location is important on redirect responses. strict-transport-security tells supporting browsers to prefer HTTPS for a defined period. content-security-policy can restrict which scripts, styles, frames and other resources a page is allowed to load.
Other headers may come from a CDN, reverse proxy, web server, application framework or upstream service. Their meaning depends on the platform, so treat a header dump as evidence to interpret rather than as an automatic security score.
Common HTTP header troubleshooting scenarios
Changes are not appearing
Inspect cache-related headers and CDN fields. A stale response may be held by a browser, reverse proxy or edge cache even after the origin has changed.
Unexpected redirect
Check the HTTP status and location header, then use the Redirect Checker when you need to see every hop in a redirect chain.
Wrong file or MIME type
Check content-type. Incorrect MIME types can affect downloads, API clients, scripts, stylesheets and browser security behavior.
Security header review
Confirm that expected browser policies are actually present on the production response. The correct policy values depend on the application and should not be copied blindly.
Why your browser may show different headers
Responses can vary by cookies, authentication, user agent, geography, request method, Accept headers, bot protection, CDN routing and A/B testing. This checker shows the response received by its server-side diagnostic request, so use browser developer tools when you specifically need the response for your own logged-in browser session.
What this checker does not prove
A header being present does not automatically make a site secure, fast or correctly cached. Likewise, a missing header is not always a vulnerability. Security and caching decisions depend on the application, resource type and intended behavior. This tool reports the response so you can diagnose it; it does not assign a security grade.
Related website tools
Frequently asked HTTP header questions
What is an HTTP response header?
It is metadata sent with an HTTP response before the response body. Headers can describe caching, media type, redirects, cookies, security policies, server behavior and other properties of the response.
Why is the Server header missing?
Many sites intentionally omit or minimize server-identification headers. A CDN or reverse proxy can also hide or replace the header sent by the origin server.
Can I use headers to check whether a page is cached?
Headers can provide strong clues, especially cache-control, age, etag and CDN-specific cache-status fields. The exact header names and semantics vary by platform.
Does a 200 status mean the page is correct?
No. HTTP 200 only means the server returned a successful response at the protocol level. The body can still contain an application error, unexpected content or stale data.