Server Diagnostics Tool Free Tier · 30 req/min

HTTP Response Header Checker

Inspect raw server response headers, HTTP status codes, redirect sequences, and HTTP security policies (HSTS, Content Security Policy, X-Frame-Options) returned by any web server.

Sample queries: example.com · google.com · cloudflare.com

Notice

HTTP request to example.io timed out or could not be completed.

Suggestions:

The remote host may be offline, firewalled, or blocking automated inspection requests
The server took longer than 10 seconds to respond, exceeding the query timeout threshold
Verify that DNS records for this hostname are responding and that the server has an active web server on port 80/443

HTTP Security Headers

Modern web applications enforce client security through HTTP response headers. Essential defenses include Strict-Transport-Security (HSTS forces HTTPS), Content-Security-Policy (mitigates cross-site scripting), and X-Content-Type-Options: nosniff.

Caching & Edge Delivery

Headers like Cache-Control, ETag, Age, and CF-Cache-Status dictate how edge CDNs and client browsers cache static and dynamic assets. Proper cache directive tuning minimizes server compute load and improves Core Web Vitals.

Redirect Chains (301 vs 302)

A 301 status represents a Permanent Redirect, instructing search engines and browsers to update bookmarks and pass PageRank. A 302 status is a Temporary Redirect. Header checks ensure canonical HTTPS and www/non-www rules redirect cleanly without circular redirect loops.

Frequently Asked Questions

What are HTTP response headers and why are they important?

HTTP response headers are metadata key-value pairs returned by a web server to the client browser before the HTML payload is delivered. They dictate client caching rules, set cookies, describe content encoding, and instruct browsers which security policies to enforce.

What is HSTS (HTTP Strict Transport Security) and how does it protect users?

HSTS (the Strict-Transport-Security header) instructs web browsers to only communicate with the domain using HTTPS for a specified duration (e.g. max-age=31536000). It protects users against man-in-the-middle attacks and prevents protocol downgrade or SSL stripping.

What is the difference between a 301 and 302 redirect header?

A 301 Moved Permanently status informs browsers and search engines to permanently cache the destination URL and pass link equity. A 302 Found status is temporary, instructing browsers to continue querying the original URL for future requests.

Why do some HTTP header checks show 'CF-Cache-Status' or 'Server: cloudflare'?

Websites behind Content Delivery Networks (CDNs) or reverse proxies like Cloudflare or Fastly show edge headers. Headers like CF-Cache-Status: HIT indicate that content was served directly from an edge cache point-of-presence rather than the origin server.

What is the rate limit for checking HTTP response headers?

Free lookups are limited to 30 requests per minute per IP address. This sliding window limit protects target origin web servers from excessive automated query volume.