HTTP Header & Redirect Checker

Check HTTP response headers, trace redirect chains (301/302), and audit security headers (HSTS, CSP). Free URL checker.

Enter a URL and look up.

Waiting

Enter a domain and run a lookup to see results.

Redirects

—

Headers

—

Security Audit

—

Performance

—

curl equivalent
—

Tool Features

Related Guides

Redirect loop diagnosis HTTP security headers guide Check SSL status as well OWASP
Pro When security headers change, monitoring checks daily and emails you.

HTTP Security Header & Redirect Checker

Trace HTTP redirect chains (301/302/307), inspect response headers and check security headers such as CSP, HSTS, X-Frame-Options, Permissions-Policy, COOP, CORP and COEP. Ten headers are shown; the A+ to F grade uses six core ones — CSP 25, HSTS 20, X-Frame-Options 15, X-Content-Type-Options 15, Referrer-Policy 15, Permissions-Policy 10 — minus 3 points per information-leak header. COOP, CORP, COEP and the deprecated X-XSS-Protection are shown but do not change the grade. Server, X-Powered-By and X-AspNet headers are flagged as information leaks.

How It Works

A request is sent to the target URL and redirects are followed for up to 10 hops, recording the status code, headers and target at each step. Cloudflare rewrites headers such as server and cf-ray on requests made from Workers, so the final URL's headers are re-read from our Seoul server when it is available. The final response's security headers are then scored as above and checked for information leaks. It also checks the Secure and HttpOnly flags of the cookies the responses set, scripts and images the final HTML loads over plain HTTP (mixed content), public library CDN scripts loaded without an integrity hash (SRI), scripts from CDNs taken over in 2024 (polyfill.io and others), and JavaScript libraries whose version in the script address has known vulnerabilities (RetireJS rules — high or critical is a warning, medium or low a note) — reported separately from the grade.

FAQ

What security headers should every site have?

At minimum: Content-Security-Policy (limits XSS), Strict-Transport-Security (forces HTTPS), X-Frame-Options (prevents clickjacking) and X-Content-Type-Options (prevents MIME sniffing). For A+ (95 points or more) you also need Referrer-Policy and Permissions-Policy.

What is the difference between 301 and 302 redirects?

301 is permanent — search engines transfer link equity to the new URL. 302 is temporary — search engines keep indexing the original URL. Use 301 for domain migrations and URL restructuring. Use 302 for A/B tests or temporary maintenance pages.

Why does my site leak server information?

Headers like Server, X-Powered-By, and X-AspNet-Version reveal your stack to attackers. Remove them in your web server configuration. In nginx: server_tokens off. In Apache: ServerTokens Prod and Header unset X-Powered-By. In Express: app.disable('x-powered-by').

Why is my grade different from Mozilla's HTTP Observatory?

Observatory starts every site at 100 and adds penalties and bonuses, up to 145. Here 100 points are split over six headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — with no bonuses; cookies, mixed content and script integrity are reported as findings, not graded. On 17 October 2026 github.com and stripe.com scored A+ (115) on Observatory and A (90) here, the difference being their missing Permissions-Policy. A site that answers our reader with a block page (403/429) is not graded.