Skip to main content
wp-config.org

Website and domain checks

HTTP headers and redirect checker

Check the public HTTP response headers and redirects of an address, with explanations of the HTTPS, cache and security settings you can see.

  • Redirect chain
  • Security headers
  • Cache headers

Free, no sign-up. Lookups and results are not saved by this site.

This tool needs JavaScript. Turn JavaScript on and reload the page.

HTTP headers

What this check looks at

  • At most five HEAD requests: the first one and up to four redirects. Each address must be public and use a standard HTTP or HTTPS port.
  • A selected set of response headers, with plain notes on which security and caching headers were seen. Cookies and page bodies are left out.
  • HEAD can give a different answer from GET. If a site blocks HEAD or does not support it, you see its answer as it came, with no GET fallback.
  • Seeing a header does not mean the policy is right, that a page came from a cache, that the TLS setup is strong or that the site has no vulnerabilities.

Read more: How HEAD requests work (opens in a new tab) and Cache-Control reference (opens in a new tab).

What you can do

  • Header checks for public HTTP and HTTPS addresses

  • The redirect chain, up to four redirects

  • Notes on visible security headers

  • Cache-Control and content type context

  • A fresh security check before every request

How to use it

  1. Enter the address

    Enter a public HTTP or HTTPS address without a username, password or other secrets.

  2. Run the check

    Start the check. A quick Cloudflare security check runs first, then this site requests the headers.

  3. Read each response

    Review each redirect and the final headers. Change the settings in your real application and check again after you deploy.

What the headers tell you, and what they do not

Response headers show how a server answers before any page content arrives: where it redirects, how long browsers and CDNs may cache the response and which security policies it sends. This check makes HEAD requests from this site's server, follows up to four redirects and explains the headers it finds.

Know the limits

Only standard public HTTP and HTTPS ports are checked, with at most five HEAD requests. Some servers answer HEAD differently from GET or block automated requests. Only selected headers are returned: no cookies, signed-in pages, page content, TLS grade or security audit. A header being present does not mean its policy is right.

Related tools

  • Redirects

    Map addresses and test your redirect rules.

  • Nginx

    Prepare routing, HTTPS and cache configuration.

  • DNS lookup

    Review DNS records and email policies.