HTTP Response Header Checker

HTTP Response Header Checker is an online inspection tool for web developers, DevOps engineers, and SEO professionals. Enter any public URL to view its status code, complete HTTP response headers, redirect chain, and final destination - perfect for diagnosing redirect issues and verifying server and security header configurations.

Key Features

• Full header inspection: All response headers listed by name and value, with one-click copy for a single header or everything at once.
• Summary panel: Status code, Content-Type, Server, and total response time at a glance, with status codes color-coded by category.
• Redirect chain analysis: Optionally follow redirects and see each hop's status code, timing, Location target, and headers, plus the final URL and hop count.
• Security header overview: Automatically checks HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, with a plain explanation for each.
• Set-Cookie parsing: Each cookie is broken out with its HttpOnly, Secure, SameSite, Path, Domain, and Expires attributes clearly flagged.
• curl command fallback: For localhost or private-network URLs, or when online inspection fails, ready-made curl commands for Windows and Linux/macOS are generated for you to run locally.

Use Cases

• Verify that HTTP-to-HTTPS redirects work and check for unnecessary redirect chains.
• Confirm a site sets security headers such as HSTS and CSP.
• Find the final landing page of shortened or tracking links.
• Inspect Set-Cookie values and confirm cookie security attributes.

How to Use

1. Enter the URL to inspect. If no scheme is given, https is added automatically.
2. Choose whether to follow redirects and whether to allow HTTPS-to-HTTP downgrades.
3. Click "Inspect" and review the summary, security headers, full headers, and redirect chain.
4. Use the copy buttons next to any item to grab the data you need.

FAQ

Q: Is this tool free?

A: Yes, free to use with no registration. Just enter a URL and inspect it.

Q: Can I check localhost or intranet addresses?

A: Online checks only reach public addresses - private networks are never probed. For such URLs the tool generates curl commands you can run on your own machine to view the headers.

Q: What does "Allow HTTPS→HTTP downgrade" mean?

A: When following redirects, landing on HTTP after HTTPS is a security downgrade. Uncheck the option and the inspection stops when such a downgrade is detected, helping you spot unsafe redirect setups.

Q: Can I see the headers of every redirect hop?

A: Yes. The redirect chain shows each hop's status, timing, and Location. Click "Show headers" on any hop to expand its full response headers.