All 127 tools

HTTP Header & Redirect Checker

Paste response headers or curl -I output to check status codes, redirect chains, caching, compression and security headers like HSTS and CSP.

Runs in your browser. Nothing you paste is sent anywhere.

Final status
200
Redirects
2
Security headers
3 of 6
Headers (final)
9

  • 2 redirects before the final response

    A short chain is fine.

  • Final status 200 OK

  • Strict-Transport-Security

    max-age=31536000; includeSubDomains

  • Content-Security-Policy missing

    Limits where scripts and other resources can load from, which blocks most XSS attacks.

  • X-Content-Type-Options: nosniff

  • No clickjacking protection

    Add X-Frame-Options: SAMEORIGIN or CSP frame-ancestors 'self'.

  • Referrer-Policy

    strict-origin-when-cross-origin

  • Content-Type

    text/html; charset=utf-8

  • Compressed with br

  • Cache-Control

    public, max-age=600

  • server reveals a version

    nginx/1.24.0. Hide version numbers so attackers cannot look up known bugs.

  • x-powered-by reveals a version

    PHP/8.2.1. Hide version numbers so attackers cannot look up known bugs.

  • Cookie 'session' lacks Secure, SameSite

    Session cookies should be Secure, HttpOnly and SameSite=Lax or Strict.

Response chain
#StatusMeaningLocation
1301Moved Permanently (permanent redirect)https://example.in/
2301Moved Permanently (permanent redirect)https://www.example.in/
3200OK

About this tool

Run curl -sIL https://example.com in a terminal, or copy the response headers from your browser's Network tab, and paste them here. The checker follows each response in a redirect chain and explains status codes, caching and missing security headers.

How to use it

  1. In a terminal, run curl -sIL followed by your URL, or copy the response headers from your browser's Network tab.
  2. Paste the output into the box.
  3. Review the redirect chain and the checks for security, caching and compression.

Questions

How do I get a page's response headers?

In a terminal run curl -sIL followed by the URL; -I fetches headers only and -L follows redirects. In Chrome, open DevTools, go to Network, click the page request and copy the response headers.

Should I use a 301 or 302 redirect?

Use 301 (or 308) for a permanent move so search engines pass signals to the new URL. Use 302 or 307 only for genuinely temporary moves.

Which security headers matter most?

Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, a Referrer-Policy and frame protection through CSP frame-ancestors or X-Frame-Options.

Last reviewed 16 October 2026.