HomeDevHTTP Header Checker
Web tools

HTTP Header Checker

Use this free CalculatorX tool for fast local results with clear formulas, worked examples, and privacy-first browser calculation. Fast and free.

Loading tool…

Loading Preparing tool…

How to use

Follow these steps for a clear answer.

1

Enter a URL

Paste the page or asset URL you want to inspect.

2

Fetch headers

Run the check to retrieve response headers via our server probe (not blocked by browser CORS).

3

Inspect caching and redirects

Review Content-Type, Cache-Control, Location, security headers, and the full redirect chain.

HTTP header checker specification

Version 1.1.0 · Last reviewed 2026-07-28

Definition
HTTP response headers are metadata sent with a status code that tell clients how to cache, interpret, secure, and follow a response.
What it calculates
Live response headers and status for a public URL, including optional redirect-chain hops with per-hop headers.
Inputs
  • Absolute URL (schemeless hosts normalized to https://)
  • User-Agent preset
  • Follow redirects (on/off)
Outputs
  • Status code and reason phrase per hop
  • Full response header map for each hop
  • Redirect Location targets when present
Formula
GET url (redirect=manual) → status + header map; follow Location when enabled

Enter a public URL to fetch live response headers and status—useful for caching, redirects, MIME types, and security header checks without opening browser DevTools.

Common response headers

Header Purpose
Content-Type MIME type of the response body
Content-Length Size of response body in bytes
Cache-Control Caching directives
Expires Expiration date for caches
Location Redirect target URL (3xx)
Server Server software identifier
Set-Cookie Cookies sent to the browser
Strict-Transport-Security HSTS policy
Content-Security-Policy Script/resource policy
X-Frame-Options Clickjacking protection
Access-Control-Allow-Origin CORS allowlist
CF-Cache-Status / X-Cache CDN cache hit/miss (when present)

Use cases

  • Verify redirects — confirm Location and 301/302 after 301 Redirect Code Generator setup
  • Debug caching — inspect Cache-Control, Expires, and CDN cache headers
  • Check security headers — HSTS, CSP, X-Frame-Options
  • Troubleshoot CORS — read Access-Control-Allow-Origin
  • Confirm MIME type — ensure Content-Type matches the resource

Example: 301 redirect

HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/new-page.html

Example: HTML document

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=600

For bulk status and redirect-chain reviews, use the HTTP Status Checker.

Assumptions
  • Checks are proxied through CalculatorX; private hosts are blocked.
  • Response bodies are discarded; only headers and status are returned.
  • Header names are lower-cased as returned by the runtime Headers API.
Units
  • Header fields: name → value strings
  • Timing: milliseconds
Boundary conditions
  • Timeout ~12s per hop; max 10 redirect hops.
  • Blocked or invalid hosts return an error.
Example
GET https://example.com → 200 + Content-Type: text/html; charset=UTF-8
Validation cases
  • Content-Type on HTML page → text/html (often with charset)
  • 301 response → Location header pointing at destination
Sources
  • RFC 9110 HTTP Semantics
Last reviewed
2026-07-28
Calculation version
1.1.0
→ HTTP Status Checker › → 301 Redirect Code Generator ›

Frequently asked questions

Key distinctions behind the tool.

What is the Location header?

On 3xx responses, Location tells the client where to go next. Use it to verify redirects after a migration or HTTPS upgrade.

How is this different from status codes?

Status codes classify the outcome (200, 301, 404). Headers carry details such as Content-Type, Cache-Control, and security policies.

Can I see Cache-Control and CDN headers?

Yes. The checker surfaces Cache-Control, Expires, and common CDN fields such as CF-Cache-Status or X-Cache when present.

Why use a server-side checker?

Browsers cannot freely read cross-origin response headers because of CORS. Our probe fetches headers from the edge for public URLs.

Which security headers should I look for?

Common ones include Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, and Access-Control-Allow-Origin for CORS.