What HTTP headers tell you
Every response your server sends starts with headers — and they control far more than most
audits check: whether the page can be cached (Cache-Control), whether it can be
indexed (X-Robots-Tag overrides your meta robots tag), where redirects land
(Location), how long content is fresh, compression, cookies, and the security
posture browsers enforce. Because headers are invisible in the page itself, misconfigurations
survive for years — this tool makes them visible in one request.
The headers worth reading first
| Header | What it controls | Watch for |
|---|---|---|
Location + status | Redirect target and type | 302 where a permanent 301/308 is intended; chains of 3+ hops |
X-Robots-Tag | Indexing directives at HTTP level | A stray noindex here silently deindexes pages |
Cache-Control | Browser & CDN caching | no-store on static assets; missing max-age |
Content-Type | How the body is interpreted | Missing charset; HTML served as text/plain |
Strict-Transport-Security | Forces HTTPS on repeat visits | Missing on HTTPS sites |
Vary | Cache correctness per client | Missing Vary: Accept-Encoding; overly broad Vary killing cache hit rate |
Reading a redirect chain
A healthy redirect setup resolves in one hop. The classic accidental chain
looks like http://example.com → https://example.com →
https://www.example.com → https://www.example.com/ — three hops
where one server rule could do it. Every hop adds a round trip (this tool shows the latency
of each) and leaks a little ranking signal. Fix chains at the first redirect: point it
directly at the final destination.
Frequently asked questions
How do I check the HTTP headers of a URL?
Enter the URL, pick a user agent (real browser, Googlebot, curl…) and click Check. You get the full response header set for every hop in the redirect chain, with status codes, latency per hop, and plain-English explanations of the headers that matter.
Why test with a Googlebot user agent?
Sites sometimes serve different responses to Googlebot than to users — different redirects, different cache rules, sometimes accidental cloaking that tanks rankings. Comparing the browser view and the Googlebot view side by side is the fastest way to catch it.
What is a redirect chain and why does it matter?
A redirect chain is when URL A redirects to B, which redirects to C. Each extra hop slows users down and dilutes link equity, and Google stops following after ~10 hops. Chains commonly appear after multiple site migrations (http→https→www→trailing slash). This tool shows every hop so you can collapse them into a single redirect.
Which security headers should my site send?
The practical set: Strict-Transport-Security (forces HTTPS), X-Content-Type-Options: nosniff, Content-Security-Policy, X-Frame-Options (or CSP frame-ancestors) and Referrer-Policy. The tool grades all five and shows exactly which are missing.
Is there a daily limit?
No limits, no captcha, no signup — unlike most header checkers which cap free use at 20–100 queries per day.