Technical

HTTP Header Checker

Read what a server actually sends back

In build

Enter a URL and get the status line and every response header the server returned, with the caching, indexing and security headers read back in plain terms, the headers on each redirect before it, and the raw block to copy.

Get early access

What it returns

The status line and the full header set in the order the server sent it, for the final URL and for every hop that preceded it.
The caching headers read together rather than one at a time: what Cache-Control, ETag, Last-Modified, Expires and Age tell a browser and a CDN to do.
The headers that change how a page is treated in search: x-robots-tag, a canonical sent as a Link header, content type and the declared character set.
Which security headers are present and which are absent, with HSTS, content security policy, x-content-type-options and referrer policy named either way.

When this matters

A page is served through a CDN and nobody can agree on why a copy change took most of a day to appear for some visitors. The answer is in the headers: a long max-age with no revalidation, an Age value showing the object was already hours old when it arrived, and a Vary splitting the cache more ways than anyone intended. The same view answers the quieter version of the problem, an x-robots-tag noindex left on a template by whoever built it, which no amount of reading the page source will ever reveal because it was never in the HTML.

How to answer this today

Site audit reads response headers on every URL it crawls and runs the full rule set across them, so a noindex header, a missing or conflicting canonical, a wrong content type and a cache policy that contradicts the page all surface as issues tied to the URLs affected. Reading the raw headers for one URL, including a staging host or an endpoint that is not part of any crawl, is what this tool is for.

Site audit

Why this is harder than it looks

Headers depend on the request

A server can vary its answer by user agent, Accept-Encoding, cookie, or the address asking. Headers fetched by a tool are the headers the site sends that tool, which is useful and is not automatically what Googlebot, a logged-in visitor or a mobile browser receives.

The hop you look at matters

Looking only at the final URL hides the headers on the redirect that got you there, and a cache or security header set on the first hop alone is easy to miss entirely. Every response in the chain carries its own header block, and they disagree more often than people expect.

Intermediaries rewrite

A CDN, a reverse proxy and a firewall each add, strip and overwrite headers on the way through, so what the origin set is not always what arrives. When a header is missing, which layer dropped it is a second investigation that reading the response cannot settle.

Rate limits

A header fetch is cheap for us and still a real request against someone else's origin. The per-visitor limit keeps a header check from being looped into a load generator, and keeps the service from being used to probe hosts that never asked to be probed.