HTTP Header Checker
See every HTTP response header a URL returns, for each hop of a redirect chain. Headers that matter for SEO, caching and security are explained, and missing security headers are flagged. Check up to 100 URLs at once.
Headers worth checking
| Header | Why it matters |
|---|---|
X-Robots-Tag | A noindex here keeps a URL out of search even when the HTML has no robots tag. It's the only way to noindex PDFs and images, and a common cause of pages vanishing after a server change. |
Link | Can declare the canonical URL and hreflang alternates, which matters for files that have no HTML head. |
Location | Where a redirect goes. Each hop is listed with its own headers. |
Cache-Control | Long cache lifetimes for images, fonts and scripts make repeat visits fast; HTML usually needs a short one or revalidation. |
Content-Encoding | Text responses should be compressed with Brotli (br) or gzip. |
Strict-Transport-Security | Makes browsers use HTTPS only, closing the gap before the HTTP-to-HTTPS redirect. |
Vary | Vary: User-Agent splits caches by browser; use it only if you really serve different HTML to different devices. |
The six security headers
Each result counts how many of these are set on the final response: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, frame protection (X-Frame-Options or a CSP frame-ancestors), Referrer-Policy and Permissions-Policy. They don't affect rankings, but they protect visitors from clickjacking, content sniffing and injected scripts. Most hosts and CDNs let you add them without touching code.
Questions
Why are some headers different from what my browser shows?
Servers can vary headers by user agent, location, cookies and whether a CDN cache is warm. Requests are made from our server without cookies, so headers set for logged-in visitors won't appear. Switch to Googlebot to see what Google is sent.
How do I check for an X-Robots-Tag noindex across many URLs?
Paste up to 100 URLs here and any URL with an X-Robots-Tag is flagged. For noindex in headers and HTML together, plus robots.txt, use the Indexability Checker.
Is a missing Content-Security-Policy a problem?
It's the hardest of the six to add, because a strict policy can break scripts the site relies on. Start with Content-Security-Policy-Report-Only, watch what it would block, then enforce it.