HTTP headers checker
See every response header a URL sends, live from outside your network, with the security headers that should be there marked present or missing.
Related tools: Is my website down? · Redirect checker · HTTP status checker · Security headers checker · TTFB test · Uptime calculator · All free tools
What the server says before it sends the page
Every HTTP response starts with headers: the status code, what the content is, how long it may be cached, which server produced it, and the security policies the browser should apply. This tool requests a URL from Cloudflare's network, follows any redirects, and lists the headers of the final response exactly as received, with six common security headers checked off. Response bodies are never read.
Headers describe one response. Whether the site keeps responding at all is a different question, and Upcheck requests every website every 5 minutes and alerts your team when it stops answering.
Three steps, no signup
- 01
Enter a URL
A full URL with a path if you want, or just a hostname; https is assumed when no scheme is given.
- 02
We request it from outside
A real GET from Cloudflare's network, redirects followed, caching disabled, body discarded.
- 03
The headers come back
Status and the headers that matter most first, then the security checklist, then everything.
Frequently asked questions
What are HTTP response headers?
Metadata the server sends before the body of a response. Some describe the content (content-type, content-length, content-encoding), some control caching (cache-control, etag, expires), some identify the software (server, x-powered-by), and some instruct the browser on security policy (strict-transport-security, content-security-policy). Browsers read them on every request; people usually only look when something is wrong.
Which security headers should a site send?
The six this tool checks are the usual baseline. Strict-Transport-Security makes browsers use HTTPS on later visits. Content-Security-Policy limits where scripts and other resources may load from, which blunts cross-site scripting. X-Content-Type-Options: nosniff stops browsers guessing content types. X-Frame-Options (or CSP's frame-ancestors) prevents your pages being framed for clickjacking. Referrer-Policy controls what URL is leaked to other sites. Permissions-Policy turns off browser features the site doesn't need.
Why does the Server header say Cloudflare or nginx instead of my application?
Because the response you see comes from whatever sits in front of your application: a CDN, a reverse proxy, a load balancer. Each layer can add, rewrite, or remove headers, so the headers a visitor receives are the sum of the whole chain. That is also why security headers set in your application code sometimes never reach the browser: a proxy in the middle dropped them.
Can I check the headers of a page behind a login?
Not the page itself. The tool sends an anonymous request with no cookies, so a page that requires a session returns whatever the site shows to a logged-out visitor, usually a redirect to the login page or a 401. You can still check that response's headers, which is often what you want, since security headers should be set site-wide.
Is this HTTP header checker free?
Yes. No account, no limit on checks by hand; scripted use is rate limited so the tool can't be used to hammer other people's servers. Upcheck's paid monitoring requests every website you add every 5 minutes and alerts your team when the status code stops being a 2xx.
One request shows the headers. Monitoring shows when the site stops answering.
Add your websites to Upcheck and get alerted by email, Slack, Discord, Teams, or webhook the next time one goes down.