HTTP Header Checker
An HTTP header checker requests a URL and shows the response headers the server sends back — the status code, caching and cookie fields, and the security headers a browser acts on. This one adds a 0–100 score from seven of them: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy and Permissions-Policy. Checking github.com returns 200 OK in about 60 ms, 17 headers and 90/100, grade A+.
Security Headers
All Response Headers
| Header | Value |
|---|---|
What does this HTTP header checker report?
Enter a domain and the checker makes a HEAD request to it from our server, then prints the status code, the round-trip time in milliseconds, the full list of response headers, and a 0-100 security score built from HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy and Permissions-Policy. It reports what the server sent; it does not follow redirects and does not read the page body.
Popular Tools
About HTTP Header Checker
This HTTP header checker takes a URL, makes a HEAD request to it from our server and prints what came back: the status code with its reason phrase, the round-trip time in milliseconds, and every response header the server sent. Checking github.com returns 200 OK in roughly 60 ms and 17 header fields, from content-type and etag to the whole content-security-policy value.
The Security Score card grades seven headers out of 100. Strict-Transport-Security and Content-Security-Policy are worth 20 points each, X-Content-Type-Options and X-Frame-Options 15 each, and X-XSS-Protection, Referrer-Policy and Permissions-Policy 10 each. Ninety points or more is an A+, 80 an A, 70 a B, 60 a C, 40 a D and anything below that an F. github.com scores 90/100 because Permissions-Policy is absent; example.com sends none of the seven and scores 0.
The score counts presence, not quality. A value of x-xss-protection: 0 switches that filter off and still earns its ten points, and a content-security-policy-report-only header earns none, so read the values printed under each Present row rather than the grade alone. Redirects are not followed: google.com answers 301 with location: https://www.google.com/, and you have to paste that address in to score the destination. The request is HEAD-only, so no HTML, meta tag or page text is examined, it gives up after ten seconds, and twenty checks a minute are accepted from one address.
The URL you type is sent to this site's server, which makes the request for you with the user agent FreeWebTools Header Checker/1.0 and none of your cookies or session, so you see what an anonymous visitor receives. Private and reserved IP ranges, localhost, cloud metadata endpoints and administrative ports such as 22, 3306 and 6379 are refused.
Use Cases
How to check a website's HTTP response headers
Type a domain or a full address into the search box, for example example.com; the https:// prefix is added for you. You can also click one of the samples next to Try: google.com, github.com, cloudflare.com or stackoverflow.com.
Press Enter or click Check. The request leaves our server as a HEAD request, so only the headers come back, never the page body.
Read the three summary cards: Status Code with its reason phrase, Security Score out of 100 with its letter grade, and Response Time in milliseconds.
Work through Security Headers to see which of HSTS, CSP, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy and Permissions-Policy are marked Present or Missing, and read the value shown under each one that is present.
Open All Response Headers to read every header name and value the server returned, including caching, cookie and CDN fields the score does not cover.
Click Copy to put the whole report — URL, status, score with grade and the header list — on your clipboard as plain text.
Pro Tips
- Type the bare domain: the box adds https:// for you, so github.com is checked as https://github.com. Write http:// explicitly to see the plain-HTTP answer, where strict-transport-security is normally absent because RFC 6797 tells browsers to ignore it over an insecure connection.
- The score rewards presence, not the value. github.com sends x-xss-protection: 0, which switches the filter off, and still collects the full ten points, so read the grey value line under each Present row before you trust the grade.
- A report-only policy scores nothing. google.com sends content-security-policy-report-only and no enforcing policy, so it loses all 20 CSP points; the Present badge only appears for the exact header name content-security-policy.
- When the Status Code card shows 301 or 302, copy the location value out of the header table and run a second check on it. The redirect response itself carries almost no security headers, which is why google.com lands at 25/100.
- The Copy button puts the whole report on your clipboard as plain text — URL, status, score with grade and every header — which is what you paste into a ticket. Pace bulk work at twenty checks a minute; beyond that the API answers 429 and the page shows a generic failure message.
Troubleshooting
The page shows "Failed to check headers. Please verify the URL is accessible." even though the site opens normally in your browser.
That generic message appears when the request came back unusable. The most common cause is the rate limit: more than twenty checks in one minute from the same address and the API answers 429 Too Many Requests. Wait a minute and try again. The same message appears when the server takes longer than the ten-second timeout to answer a HEAD request.
The error line reads "Connection failed: SSL certificate problem: certificate has expired".
The certificate is verified rather than trusted blindly, so an expired, self-signed or wrong-hostname certificate stops the check instead of producing a misleading report. Renew or fix the certificate, or check the http:// address to read the headers the server sends before TLS is involved.
The error line reads "Internal URLs not allowed", "Private IPs not allowed" or "This port is not allowed".
The checker refuses localhost, private and reserved IP ranges, cloud metadata endpoints and the ports 22, 23, 25, 3306, 5432, 6379, 11211, 27017, 8080 and 8443, so it cannot be turned into an internal network scanner. Use a publicly resolvable hostname on port 80 or 443; for a local server, run curl -I from the machine itself.
The Status Code card shows 301 or 302 and only a handful of headers, with a poor security score.
Redirects are deliberately not followed, so what you are grading is the redirect response, not the destination. google.com answers 301 with location: https://www.google.com/ and scores 25/100 for that reason. Copy the location value out of the header table and run a second check on it to grade the page users actually land on.
The error line reads "Connection failed: Could not resolve host".
Our server found no public DNS record for that hostname. Check the spelling, remove any stray space or quote you pasted with the address, and confirm the domain resolves from outside your network. A host that exists only in your hosts file, on a VPN or on an internal resolver cannot be reached from here.
Frequently Asked Questions
Type the domain into the box at the top of this page and press Enter or click Check. Our server sends a HEAD request to that URL and the page fills three cards — Status Code, Security Score, Response Time — followed by the Security Headers review and a table of every header returned. github.com answers 200 OK in about 60 ms with 17 fields. No extension, curl command or DevTools session is involved.
An HTTP header is a name-and-value line attached to a request or a response to describe it. content-type: text/html; charset=utf-8 states the media type, cache-control states how long the answer may be reused, location names the target of a redirect. RFC 9110, HTTP Semantics, defines the field syntax and the registry of field names. Headers travel alongside the body, never inside it; this page lists response headers only.
The seven scored here are Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy and Permissions-Policy. HSTS and CSP weigh 20 points each, X-Content-Type-Options and X-Frame-Options 15 each, the remaining three 10 each. MDN marks X-XSS-Protection deprecated and non-standard and recommends a strong Content-Security-Policy instead, so treat those ten points as a legacy signal rather than a target.
Run the check and read the Security Headers section: each of the seven headers carries a Present or Missing badge, a one-line description and, when present, the exact value the server returned. The Security Score card turns that into 0-100 with a letter grade — 90 and above is A+, 80 an A, 70 a B, 60 a C, 40 a D, below 40 an F. github.com scores 90/100 with only Permissions-Policy missing.
Press F12 to open DevTools, switch to the Network tab, reload the page, click the document request and read the Response Headers panel. That shows what your own browser received, cookies and content negotiation included. This page is the neutral counterpart: the request leaves our server with the user agent FreeWebTools Header Checker/1.0 and no cookies, so you see what an anonymous visitor gets.
Headers carry everything about a message that is not the body: the outcome of the transfer, the media type and encoding, caching and revalidation rules, cookies, and the security policies a browser has to enforce. Without content-type a browser must guess the format; without strict-transport-security it may keep talking plain HTTP; without content-security-policy an injected script runs unchallenged. The body alone can express none of that.
Each field is a name, a colon, optional whitespace and a value on one line, as in x-frame-options: deny. RFC 9110 section 5.1 makes field names case-insensitive, and HTTP/2 requires them in lowercase, which is why the table above shows content-type rather than Content-Type. A field may legitimately repeat, and this checker keeps the last value it parses for a repeated name.
Yes. TLS encrypts the whole HTTP message, headers included, so an observer on the network sees the destination IP address and the TLS SNI hostname but not the field names, values or cookies. Over plain HTTP nothing is protected, which is what Strict-Transport-Security addresses: RFC 6797 tells the browser to use HTTPS for that host for the whole max-age window, and browsers ignore the header if it arrives over HTTP.
Field names are not. RFC 9110 section 5.1 states that field names are case-insensitive, so Content-Type and content-type are the same field, and HTTP/2 mandates the lowercase form. Values are another matter: a browser accepts x-frame-options: DENY and deny alike, but a location URL, an ETag or a nonce inside a Content-Security-Policy is compared exactly as written.
No. This page reports response headers, because the request is made by our server rather than by your browser. To read the headers your own browser sends, open DevTools, go to the Network tab and expand Request Headers, or use a request-echo endpoint. Everything shown here — the status, the score and the table — describes the site you typed, not your client.