Whoistrackr
Server Diagnostics Tool Free Tier · 30 req/min

HTTP Response Header Checker

Inspect raw server response headers, HTTP status codes, redirect sequences, and HTTP security policies (HSTS, Content Security Policy, X-Frame-Options) returned by any web server.

Sample queries: example.com · google.com · cloudflare.com

Response Headers for example.co

Real tool output fetched via HTTP GET request · 2026-10-26 23:12:00 EDT

Open in Full Lookup Studio →
Security Audit: 0 of 6 Defenses Active HTTP/1.1 200 OK

HTTP Security Headers Posture

Evaluated per OWASP Secure Headers Project
Strict-Transport-Security (HSTS) Missing

Enforces HTTPS encryption and prevents SSL-stripping man-in-the-middle attacks.

Content-Security-Policy (CSP) Missing

Restricts origins of executable scripts, stylesheets, and assets to mitigate XSS.

X-Content-Type-Options Missing

Instructs browsers to respect declared MIME types, preventing MIME-sniffing exploits.

X-Frame-Options Missing

Restricts iframe embedding to defend against clickjacking and UI redressing.

Referrer-Policy Missing

Protects user privacy by controlling referrer data passed on external links.

Permissions-Policy Missing

Explicitly disables access to sensitive browser device APIs (camera, geolocation).

Showing 4 of 4 headers Target: example.co
status_line: HTTP/2 200
status_code: 200
status_text:
headers: Tue, 27 Oct 2026 03:12:00 GMT, text/html;charset=utf-8, cloudflare, a50e84415eda6075-ORD, index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1, SAMEORIGIN, no-cache, no-store, must-revalidate, DYNAMIC, Array, a50e84415eda6075-ORD

HTTP Security Headers

Modern web applications enforce client security through HTTP response headers. Essential defenses include Strict-Transport-Security (HSTS forces HTTPS), Content-Security-Policy (mitigates cross-site scripting), and X-Content-Type-Options: nosniff.

Caching & Edge Delivery

Headers like Cache-Control, ETag, Age, and CF-Cache-Status dictate how edge CDNs and client browsers cache static and dynamic assets. Proper cache directive tuning minimizes server compute load and improves Core Web Vitals.

Redirect Chains (301 vs 302)

A 301 status represents a Permanent Redirect, instructing search engines and browsers to update bookmarks and pass PageRank. A 302 status is a Temporary Redirect. Header checks ensure canonical HTTPS and www/non-www rules redirect cleanly without circular redirect loops.

Frequently Asked Questions

What are HTTP response headers and why are they important?
HTTP response headers are metadata key-value pairs returned by a web server to the client browser before the HTML payload is delivered. They dictate client caching rules, set cookies, describe content encoding, and instruct browsers which security policies to enforce.
What is HSTS (HTTP Strict Transport Security) and how does it protect users?
HSTS (the Strict-Transport-Security header) instructs web browsers to only communicate with the domain using HTTPS for a specified duration (e.g. max-age=31536000). It protects users against man-in-the-middle attacks and prevents protocol downgrade or SSL stripping.
What is the difference between a 301 and 302 redirect header?
A 301 Moved Permanently status informs browsers and search engines to permanently cache the destination URL and pass link equity. A 302 Found status is temporary, instructing browsers to continue querying the original URL for future requests.
Why do some HTTP header checks show 'CF-Cache-Status' or 'Server: cloudflare'?
Websites behind Content Delivery Networks (CDNs) or reverse proxies like Cloudflare or Fastly show edge headers. Headers like CF-Cache-Status: HIT indicate that content was served directly from an edge cache point-of-presence rather than the origin server.
What is the rate limit for checking HTTP response headers?
Free lookups are limited to 30 requests per minute per IP address. This sliding window limit protects target origin web servers from excessive automated query volume.