HTTP header viewer: check response headers and redirects free
To use this HTTP header viewer for free, type a domain or full address into the URL or domain box and press Check Headers. The page shows the status code, each step of any redirect chain (up to five hops), a six-point security-header check, the CORS headers, and every response header. Click any header for its full value and a short explanation.
HTTP response headers are the metadata a server sends before the page itself. They decide how long browsers and CDNs cache a response, whether another site can frame it, which scripts may run and where a redirect leads, so reading them is a routine step when debugging caching, redirects, SEO or a security review.
This tool is not client-side, and it says so. A browser cannot read another site's headers, so the URL you enter is sent to ZipConvert's server, which requests it with a GET from Cloudflare's network and returns the status and headers. The page body is discarded. The site you check sees our server's IP address and a user agent naming zipconvert.com, not yours.
Table of Use: what to check and where to look
| Task | What to do | What to read |
|---|---|---|
| Trace a redirect chain, such as http to https or non-www to www | Enter the old URL with Follow redirects ticked | The Final URL line, then the Redirect Chain card with one row per hop (status and URL) |
| Check a page's status code | Enter the URL | The coloured status badge, such as 200 OK, 404 Not Found or 503 Service Unavailable |
| Review security headers before a launch | Enter the production URL | Security Headers: how many of 6 are present, with the values and notes |
| Debug caching or CDN behaviour | Enter the asset or page URL | cache-control, etag, last-modified, age and vary in All Response Headers |
| See which cookies a page sets | Enter the URL, then click set-cookie | Each cookie on its own numbered line |
| Find where a link redirects without following it | Untick Follow redirects | The first response's status and its location header |
If the chain shows redirects you did not intend, the .htaccess generator writes Apache redirect rules, and the URL encoder and URL decoder help with query strings that are being rewritten.
Features of this response header checker
- Redirect following. Up to five redirects are followed and every hop is listed. Each hop is checked against the private-address block, so a redirect to a local address is reported and not followed.
- Security check on the final response. HSTS counts only over HTTPS with a max-age above zero. Clickjacking protection counts a CSP frame-ancestors directive that does not let every site in, such as * or https: would; when a CSP sets frame-ancestors, browsers ignore X-Frame-Options. Without one, an X-Frame-Options of DENY or SAMEORIGIN counts. Content-Security-Policy, Referrer-Policy and Permissions-Policy are checked for presence only, not for strength.
- CORS card. Shows the Access-Control headers the response carries, such as allow-origin, allow-methods and allow-credentials.
- Every header, explained. All response headers are listed with a count, and 37 common ones carry a one-line explanation. Repeated Set-Cookie headers show a “sent N×” badge.
- Round-trip time. The page shows how long the check took from your browser, through our server, to the site. It is not a speed test of the site.
Key headers and what the viewer does with them
| Header | What it does | In this tool |
|---|---|---|
| Strict-Transport-Security | Tells browsers to use HTTPS only for the site | Scored; ignored over plain http or with max-age=0 |
| Content-Security-Policy | Limits which resources the page may load | Scored for presence only |
| X-Content-Type-Options | nosniff stops browsers guessing a file type | Scored; needs nosniff |
| Access-Control-Allow-Origin | Names the origins that may read the response | Shown in the CORS card |
What it does not do
The tool sends a plain GET with no cookies and no headers you can set, only its own zipconvert.com user agent, so it cannot test POST requests, authenticated pages or per-country responses. It shows response headers only. A site that does not answer within about eight seconds is reported as unreachable, and some sites block requests from servers altogether. For certificate details use the SSL certificate checker.
How to view HTTP headers, step by step
- Type a domain such as example.com, or a full address, into URL or domain. Or click one of the Try links: google.com, github.com or cloudflare.com.
- Leave Follow redirects (up to 5) ticked to see where a URL lands, or untick it to see only the first response.
- Press Check Headers or the Enter key.
- Read the status badge, the Requested and Final URL lines, and the Redirect Chain if there is one.
- Review the Security Headers card, the CORS Headers card when it appears, and the All Response Headers list.
- Click a header to expand it, or press Copy All to copy the set.
To find out where the domain points, use the DNS lookup tool; to see who registered it, the WHOIS lookup; and to locate the server's IP address, the IP address lookup.
Who can use it
- Web developers and DevOps engineers debugging caching, CDN and redirect behaviour.
- SEO specialists checking that moved pages return a 301 and that the redirect chain is short, before updating a sitemap.
- Security reviewers doing a first pass on a site's browser-side protections. When logs show an odd client, the user agent parser decodes it.
- Support teams and site owners who want headers for a ticket, copied in one click.
FAQs
How do I check the HTTP headers of a website?
Type a domain or full address into the URL or domain box and press Check Headers. The result shows the status code, the redirect chain, a security-header check, any CORS headers and a list of every response header. Click a header to see its full value and a plain-English note, or press Copy All to take the whole set as text.
Is it safe to use? Is my URL stored?
The URL you enter is sent to ZipConvert's server, because a browser cannot read another site's headers. The server requests the URL, returns the status and headers, and discards the page body. The tool keeps no record of the URL or the result; it only counts requests per IP address for a minute to enforce its limit of 30 checks. Do not paste addresses that contain private tokens.
Why are the headers different from what my browser shows?
The request comes from our server, not your browser, so the site sees a different IP address, no cookies and a user agent that names zipconvert.com. Sites that vary their response by country, login state, device or bot detection can answer differently. The tool also shows response headers only, not the request headers your browser sends.
What do the status codes 301, 302, 404 and 503 mean?
301 Moved Permanently and 308 Permanent Redirect tell browsers and search engines the address has changed for good, while 302, 303 and 307 are temporary redirects. 404 Not Found means nothing exists at that address, 403 Forbidden means access was refused, and 503 Service Unavailable means the server could not handle the request, often temporarily.
Which security headers does it check, and what does present mean?
Six checks run on the final response: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options set to nosniff, clickjacking protection, Referrer-Policy and Permissions-Policy. Present means the header was sent in a form browsers honour. For the policy headers it does not judge how strict the policy is. X-XSS-Protection is shown but not scored, because modern browsers ignore it.
Why does Set-Cookie appear more than once?
A server sends one Set-Cookie header per cookie, and they cannot be merged into one line without changing their meaning, so the viewer lists every one exactly as sent. Click the header to see them all, marked with a "sent N×" badge. Other repeated headers are combined into one comma-separated value by HTTP itself before they reach the tool.
Why does the CORS section show nothing for my API?
The CORS card appears only when the response carries Access-Control headers. Many servers send them only in reply to a cross-origin request that includes an Origin header or a preflight, and this tool sends a plain GET with neither. A missing CORS card therefore does not prove CORS is off. Test it from a page on the other origin, using your browser's Network tab.
Can I check localhost or a site on my local network?
No. The request is made from the internet, so it cannot reach addresses inside your network, and the server deliberately refuses localhost, private IP ranges and cloud metadata addresses. For a local site, use the Network tab in your browser's developer tools, or run curl -I against it from your own machine.