HTTP Header Checker

What HTTP headers are

Every time a browser or crawler asks for a page, the server answers with a status code and a set of headers before sending any content. Headers say whether the page exists, where it moved, how long it can be cached, what type of file it is and which security rules apply. Problems here are invisible on the page itself, which is why they are easy to miss.

Using the HTTP header checker

1. Enter any URL: a page, an image, a PDF or a file on a CDN.
2. Choose who to request it as: the default checker, Chrome on desktop, Safari on iPhone or Googlebot.
3. Run the check. Each redirect hop is shown with its status code, response time and full header list.
4. Read the summary at the top for security, caching and compression notes.

Using it as an HTTP status code checker

The first thing to read is the status code of each hop. As an HTTP status code checker, the tool shows the code for every step, not just the last one.

• 200 OK: the page loaded normally.
• 301 and 308: permanent redirects. Search engines move ranking signals to the new address.
• 302 and 307: temporary redirects. Fine for short changes, but use 301 for permanent moves.
• 404 and 410: not found, or removed on purpose.
• 403: access refused, often by a firewall or security plugin.
• 500 to 504: server errors. If these appear for Googlebot, crawling slows down.

What to look for as a response header checker

Once the status codes look right, use the response header checker table to review the headers of the final page.

• Security headers: Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Content-Security-Policy.
• Caching: Cache-Control and Expires decide how long browsers and CDNs keep a copy. "no-store" on normal pages makes every visit slower.
• Compression: Content-Encoding should say gzip or br for HTML, CSS and JavaScript.
• X-Robots-Tag: a noindex here hides the URL from search, even if the page looks fine.
• Server and X-Powered-By: version numbers here help attackers. Hide them where you can.

Why compare user agents

Some setups answer differently depending on who is asking. A security plugin might block Googlebot, a mobile plugin might redirect iPhones to another address, or a cache might serve crawlers an old copy. Requesting the same URL as a desktop browser and as Googlebot, and comparing the two, is a quick way to catch these problems.

For a wider look at redirects across your site, use the redirect chain scan, which follows every internal link on a page.

Official reference: MDN's HTTP headers reference describes every standard header in detail if you want to look up one from your results.