Domain & website
HTTP header checker
See every HTTP header and each step of the redirect chain for a URL, plus a checklist of security headers.
What is HTTP header checker?
Every time a browser loads a page, the server sends a set of headers alongside it. They are invisible on screen but decide a great deal: whether the page can be cached, where it redirects to, and what the browser is allowed to do with the content. Most puzzling performance and SEO problems live here rather than in the HTML.
This tool follows each redirect step individually and shows the full headers of every hop. That is the difference from the Network tab in your browser, which collapses the chain and shows you only the final result, while the thing hurting your rankings usually sits in the middle: a 302 that should have been a 301, or a four-step chain that should have been one.
You can switch identity to a phone or to Googlebot. Many servers return different content depending on who is asking, and a site that redirects Googlebot somewhere other than real visitors is a serious problem in a search engine eyes.
The security header table at the bottom checks six widely recommended headers. Missing some of them does not mean your site is unsafe, but each blank line is a defensive layer left switched off, and most of them cost a single line of configuration.
How to use
- Paste the URL you want to inspect. The scheme is optional, https is assumed.
- Try the http version of your address to confirm it upgrades to https, ideally in a single 301.
- Read the step count at the top of the chain. One step is ideal, three or more is worth shortening.
- Switch to Googlebot and check again: the result should be identical to the desktop run.
- Expand any hop to read its full headers when you need to inspect cache-control or content-type.
Frequently asked questions
What is the difference between 301 and 302?
301 is permanent: search engines pass the value of the old address to the new one and drop the old address from the index. 302 is temporary, so the old address is kept. Using 302 for a permanent move is one of the most common SEO mistakes.
Does a long redirect chain really hurt?
Yes, in two ways. Each step is a round trip to the server, so the page gets slower, most visibly on mobile networks. Search engines also follow only a limited number of steps before giving up. The classic case is a four-step chain: non-www to www, then http to https, then a trailing slash. Collapse it into one.
Why can I not check ports other than 80 and 443?
That is a deliberate limit. Allowing arbitrary ports would turn this into a port scanner running from this site server, and its address would end up on blocklists very quickly.
Are those six security headers mandatory?
Not mandatory, but worth having. Start with strict-transport-security and x-content-type-options: both cost one configuration line and have essentially no side effects. Content-security-policy is the strongest but also the hardest, and needs careful testing because a wrong value will block your own legitimate assets.