HTTP Header & Redirect Checker
See any URL’s status code, full redirect chain, all response headers and a plain-English security-header grade — checked server-side in seconds.
What this tool shows
- Final status — the HTTP status code and reason a real client ends up with (200, 301, 404, 500…).
- Redirect chain — every hop with its status and timing, so you can see exactly where a link goes and how many round-trips it costs.
- Security grade — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, each with the exact fix if it’s missing.
- All response headers — the complete header set from the final URL, ready to copy.
Common uses
- Debug a link that bounces through several redirects or lands on the wrong page.
- Confirm an HTTP → HTTPS redirect is in place and never downgrades.
- Audit a site’s security headers before launch and get the exact header to add.
- Check a 301/302 is returning the status code you expect for SEO.
- Pair it with a DNS lookup, SSL check and WHOIS for the full picture.
Frequently asked questions
What does the HTTP header checker show?
It shows the final HTTP status code (like 200, 301 or 404), every hop in the redirect chain with its status and timing, all response headers returned by the final URL, and a security-header grade covering HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
How do I check a redirect chain?
Enter the starting URL and the tool follows every redirect (up to 10 hops), listing each URL, its status code (301, 302, 307, 308…) and how long it took. It flags HTTP→HTTPS upgrades, insecure HTTPS→HTTP downgrades and redirect loops.
What is a good security-header grade?
The grade (A–F) reflects how many recommended security headers are present and well-configured. An A means strong HSTS, a Content-Security-Policy, clickjacking protection and nosniff are all in place. Each check includes the exact header to add if it is missing.
Why check headers server-side instead of in the browser?
A browser cannot read the status or headers of a cross-origin redirect — CORS hides them. This tool fetches the URL from the edge, so it can follow the full chain and read every header the way a real client would.
Is anything stored?
No. The URL is fetched server-side to read its headers and nothing is logged or stored. Requests are guarded so the tool can only reach public web addresses.