How to use the HTTP Header Checker
- Enter a URL — a page, image, CSS file or API endpoint.
- Click Check headers (or press Ctrl+Enter).
- Check the status code and redirect chain, then scan the headers table; known headers are explained in the right-hand column.
- Click Copy raw headers to paste them into a ticket, or open the Security Headers Checker for a detailed security report.
What are HTTP response headers?
Every time a browser or crawler requests a URL, the server answers with a status line (such as HTTP/1.1 200 OK), a set of headers and then the body. Headers are name–value pairs that describe the response: what type of content it is, how long it may be cached, whether search engines may index it, and which security policies the browser should enforce. They are invisible on the page, which is why so many SEO and performance problems hide there.
Headers that matter for SEO and performance
| Header | What to look for |
|---|---|
Content-Type | text/html; charset=utf-8 for pages. A wrong type can stop a page being rendered or indexed. |
Cache-Control | Long max-age for versioned static files, short or no-cache for HTML that changes. |
ETag / Last-Modified | Allow cheap revalidation (304 Not Modified) instead of re-downloading. |
X-Robots-Tag | noindex here removes the URL from search results — handy for PDFs, disastrous by accident. |
Link | Can carry rel="canonical" for non-HTML files, plus preload hints. |
Vary | Tells caches which request headers change the response; Vary: User-Agent fragments caches. |
Strict-Transport-Security | Forces HTTPS on future visits; aim for a max-age of at least six months. |
Reading Cache-Control
Cache-Control: public, max-age=31536000, immutable means any cache may store the file for a year without checking back — ideal for fingerprinted assets like app.3f2a1c.js. no-cache does not mean “don’t cache”: it means “store it, but revalidate before every use”. To forbid storage entirely, use no-store. s-maxage applies only to shared caches such as CDNs.
Checking headers yourself
In the terminal, curl -sI https://example.com prints the headers of a HEAD request, and curl -sIL follows redirects. In the browser, open DevTools → Network, reload, and click the document request. This tool shows the same information without either, follows redirects for you and explains what you’re looking at. To replay requests with custom methods and headers, try the API Tester.
Tools that pair well with the HTTP Header Checker
- cURL to Code — Paste a curl command — from API docs or “Copy as cURL” in your browser’s DevTools — and get ready-to-run code for six languages, with headers, body and authentication carried over.
- SSL Checker — Verify an HTTPS certificate in seconds — see when it expires, who issued it, which hostnames it covers and whether the chain is trusted.
- SEO Checker & Site Audit — Paste a URL to run up to 70 on-page SEO checks in seconds.
- Meta Tag Checker — See exactly how Google is likely to display your page: title and description measured in pixels, desktop and mobile previews, and every meta tag in the <head>.
Frequently asked questions
How do I check HTTP headers in my browser?
What is the X-Robots-Tag header?
X-Robots-Tag: noindex keeps a URL out of search results and works for any file type, including PDFs and images.Why don’t I see a Content-Encoding header?
curl -sI -H "Accept-Encoding: gzip, br" https://your-site.Which request does the checker send?
What is the difference between no-cache and no-store?
no-cache allows storing the response but requires revalidation with the server before reuse. no-store forbids storing it at all, which is meant for sensitive data.