HomeDevHTTP Header Checker
Web tools

HTTP Header Checker

HTTP Header Checker on CalculatorX—clear steps, local browser calculation, and no account required. Runs locally in your browser. Try it free.

Loading tool…

Loading Preparing tool…

How to use

1

Enter a URL

Paste the page or asset URL you want to inspect.

2

Fetch headers

Run the check to retrieve response headers via our server probe (not blocked by browser CORS).

3

Inspect caching and redirects

Review Content-Type, Cache-Control, Location, security headers, and the full redirect chain.

HTTP header checker specification

Version 1.1.0 · Engine tested

Calculation status
  • Engine tested 2 published cases
  • Named expert review Not performed
  • Calculation version 1.1.0

Review policy

Definition
HTTP response headers are metadata sent with a status code that tell clients how to cache, interpret, secure, and follow a response.
What it calculates
Live response headers and status for a public URL, including optional redirect-chain hops with per-hop headers.
Inputs
  • Absolute URL (schemeless hosts normalized to https://)
  • User-Agent preset
  • Follow redirects (on/off)
Outputs
  • Status code and reason phrase per hop
  • Full response header map for each hop
  • Redirect Location targets when present
Formula
GET url (redirect=manual) → status + header map; follow Location when enabled

Enter a public URL to fetch live response headers and status—useful for caching, redirects, MIME types, and security header checks without opening browser DevTools.

Common response headers

Header Purpose
Content-Type MIME type of the response body
Content-Length Size of response body in bytes
Cache-Control Caching directives
Expires Expiration date for caches
Location Redirect target URL (3xx)
Server Server software identifier
Set-Cookie Cookies sent to the browser
Strict-Transport-Security HSTS policy
Content-Security-Policy Script/resource policy
X-Frame-Options Clickjacking protection
Access-Control-Allow-Origin CORS allowlist
CF-Cache-Status / X-Cache CDN cache hit/miss (when present)

Use cases

  • Verify redirects — confirm Location and 301/302 after 301 Redirect Code Generator setup
  • Debug caching — inspect Cache-Control, Expires, and CDN cache headers
  • Check security headers — HSTS, CSP, X-Frame-Options
  • Troubleshoot CORS — read Access-Control-Allow-Origin
  • Confirm MIME type — ensure Content-Type matches the resource

Example: 301 redirect

HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/new-page.html

Example: HTML document

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=600

For bulk status and redirect-chain reviews, use the HTTP Status Checker.

Assumptions
  • Checks are proxied through CalculatorX; private hosts are blocked.
  • Response bodies are discarded; only headers and status are returned.
  • Header names are lower-cased as returned by the runtime Headers API.
Units
  • Header fields: name → value strings
  • Timing: milliseconds
Boundary conditions
  • Timeout ~12s per hop; max 10 redirect hops.
  • Blocked or invalid hosts return an error.
Example
GET https://example.com → 200 + Content-Type: text/html; charset=UTF-8
Validation cases
  • Content-Type on HTML page → text/html (often with charset)
  • 301 response → Location header pointing at destination
Sources
  • RFC 9110 HTTP Semantics
Calculation version
1.1.0
→ HTTP Status Checker › → 301 Redirect Code Generator ›

Frequently asked questions

Key distinctions behind the tool.

What is the Location header?

On 3xx responses, Location tells the client where to go next. Use it to verify redirects after a migration or HTTPS upgrade.

How is this different from status codes?

Status codes classify the outcome (200, 301, 404). Headers carry details such as Content-Type, Cache-Control, and security policies.

Can I see Cache-Control and CDN headers?

Yes. The checker surfaces Cache-Control, Expires, and common CDN fields such as CF-Cache-Status or X-Cache when present.

Why use a server-side checker?

Browsers cannot freely read cross-origin response headers because of CORS. Our probe fetches headers from the edge for public URLs.

Which security headers should I look for?

Common ones include Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, and Access-Control-Allow-Origin for CORS.