HTTP Headers Checker
Inspect the HTTP response headers of any URL — cache policy, security headers, content encoding, and more.
Enter a URL to inspect its HTTP response headers — caching policy, security headers, content encoding, and more.
About this tool
HTTP Headers Checker sends a HEAD request to any URL and returns the full set of HTTP response headers, categorised and colour-coded by type: security headers (HSTS, CSP, X-Frame-Options, etc.), caching headers (Cache-Control, ETag, Expires), and performance headers (Content-Encoding, Transfer-Encoding). Security headers that are absent are highlighted — missing HSTS or CSP headers are common findings in SEO and security audits. Use this tool to verify CDN caching configuration, check that your server is compressing responses, or confirm that required security headers are in place.
How to use
- Enter the URL you want to inspect and click Check.
- Review the status code and the list of response headers.
- Use the filter tabs to focus on Security, Caching, or Performance headers and act on any missing or misconfigured values.
Related Tools
Trace the full redirect chain for any URL and see each HTTP status code.
Fetch any URL and verify the canonical tag — detect self-referential and cross-domain canonicals.
Fetch any URL and audit every SEO meta tag — title, description, canonical, Open Graph, Twitter Card, and more.
FAQ
Why do HTTP headers matter for SEO?
Several HTTP headers directly affect SEO. Cache-Control and ETag headers influence how quickly your pages are served from CDNs and browser caches, affecting Core Web Vitals scores. The X-Robots-Tag header can block indexing at the server level (overriding HTML meta robots). Content-Encoding reveals whether your server is compressing responses — uncompressed HTML slows page load and hurts rankings.
What is HSTS and why is it important?
HTTP Strict Transport Security (HSTS) is a header that instructs browsers to only connect to your site over HTTPS, even if a user types http://. Without it, there is a brief window on first visit where a man-in-the-middle attack is possible. HSTS also slightly improves page load time by eliminating the HTTP-to-HTTPS redirect on subsequent visits. Google gives a minor ranking boost to HTTPS sites.
What does Cache-Control: no-store mean?
no-store instructs browsers and CDNs not to cache the response at all. Every request fetches the content fresh from the origin server. This is appropriate for sensitive, authenticated pages but is often mistakenly set on public pages, which hurts performance and increases server load.
Why does the tool use a HEAD request?
A HEAD request retrieves only the response headers, not the response body. This makes it fast and avoids downloading potentially large pages. All HTTP headers (including caching and security headers) are included in the HEAD response, so the result is equivalent to what a GET request would return for headers.