HTTP Header Checker
Inspect public response headers of any website
HTTP Header Checker — Complete Guide & Instructions
MakeCard HTTP Header Checker fetches a public URL and shows you the raw HTTP response headers it returns — the equivalent of curl -I without opening a terminal. Enter any domain or full URL, click Fetch Headers, and the tool displays the status code plus a clean two-column table of every header the server sent: content-type, caching directives, security headers like CSP and HSTS, cookies, and server software. Because browsers block cross-origin header reads, our server performs the fetch for you.
How to Use HTTP Header Checker
- 1 Type a URL into the "URL" field — plain domains like example.com or full URLs like https://example.com/page both work.
- 2 Click "Fetch Headers" (or press Enter).
- 3 Read the status badge — green for 2xx success, indigo for 3xx redirects, red for errors.
- 4 Scan the full header table showing each header name and its returned value.
Key Features & Capabilities
- Fetches real response headers for any publicly reachable URL.
- Colour-coded HTTP status badge for instant diagnosis.
- Complete header table — server, content-type, cache-control, set-cookie, security headers and more.
- Accepts bare domains — the scheme is added automatically.
- Clear error reporting for unreachable hosts or invalid URLs.
- No browser extension needed — the fetch is performed server-side.
Supported Formats & Specifications
| Parameter | Specification |
|---|---|
| Input | Domain or full URL (http/https) |
| Output | HTTP status code + complete response header table |
| Method | Server-side fetch to bypass browser CORS restrictions |
| Access | Free, unlimited checks |
Practical Everyday Use Cases
- Verifying that security headers — Content-Security-Policy, HSTS, X-Frame-Options — are set on your site.
- Checking whether a URL returns 200 or a redirect chain before linking to it.
- Debugging cache issues by inspecting cache-control, etag, and expires headers.
- Confirming content-type and content-encoding on API endpoints and static assets.
- Spotting the server software and CDN a site is running on.
Pro Tips for Best Results
- Test both https:// and www variants — misconfigured redirects often hide between them.
- A missing strict-transport-security header on an HTTPS site is a quick security audit flag.
- Redirect (301/302) responses show a location header — follow it and check the final destination too.
- Some headers like set-cookie can repeat; the table joins multiple values into one row.
Common Problems & Solutions
The target may block non-browser requests, require authentication, or be down. Geo-restricted or firewall-protected sites can also refuse our server-side request.
Servers vary responses by user-agent and cookies — a server-side fetch sees the "anonymous bot" view, which is usually what you want for auditing.
Privacy & Security
100% Client-Side Execution
The URL you enter is sent to our server solely to fetch that site's headers on your behalf; we do not retain a lookup history or the sites you check.
Frequently Asked Questions
Everything you need to know about using HTTP Header Checker
Enter the URL above and click Fetch Headers — you get the status code and every response header in a table, the same result as running curl -I.
strict-transport-security (HSTS), content-security-policy, x-frame-options or frame-ancestors, x-content-type-options: nosniff, and referrer-policy are the core set a secure site should send.
Cross-origin rules (CORS) block scripts from reading another site's headers, so this tool routes the request through our server and returns the result to you.
301 is a permanent redirect that search engines transfer ranking to; 302 is temporary. The location header shows where each redirect points.
Related FreeToolsBazaar Tools
Ready to Use HTTP Header Checker?
100% free, browser-based, and private. No installation, registration, or file upload to external servers required.
Start Using HTTP Header Checker