IMVASA

Free HTTP Header Checker

See every response header a URL sends, with its status code and redirects, and test the security headers, caching, compression, content type and X-Robots-Tag. Free, no account.

Enter any URL. Redirects are followed and the final response's headers are shown.

The Headers That Matter for SEO and Security

  • Status and redirects: only a 200 is indexed, and every redirect hop costs time.
  • X-Robots-Tag: a noindex sent from the server, easy to miss because it isn't in the HTML.
  • Cache-Control and Content-Encoding: caching and Brotli or gzip compression make repeat and first visits faster.
  • Security headers: HSTS, CSP, nosniff, Referrer-Policy and a frame policy protect visitors and the site.

Checking HTTPS itself? The SSL checker tests the certificate and the http:// redirect, and the indexability checker puts the status code and X-Robots-Tag together with robots.txt and the page's tags.

How to Check a URL's HTTP Headers

  1. 1

    Paste the URL

    Enter any page or file. Redirects are followed and the headers of the final response are shown.

  2. 2

    Read the headers

    Every response header is listed exactly as the server sent it, with the status code and response time.

  3. 3

    Review the checks

    Security headers, caching, compression, the content type and X-Robots-Tag are each tested, with the fix for anything missing.

  4. 4

    Set them at the source

    Add or change headers in your server, CDN or framework config, then run the checker again to confirm.

Check more than the headers

The free audit runs these same header checks, plus indexability, titles, schema, links, Core Web Vitals and AI-search readiness.

HTTP Header Checker FAQ

What are HTTP response headers?

They are the lines a server sends before the page itself: the status code, the content type, caching and compression rules, cookies and security policies. Browsers and search engines read them before they read any HTML.

Which HTTP headers affect SEO?

The status code decides whether a URL can be indexed at all. X-Robots-Tag can noindex a page or file from the server. The Link header can carry a canonical or hreflang. Cache-Control and compression affect how fast the page loads.

Which security headers should every site send?

Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, a Referrer-Policy, and either X-Frame-Options or CSP frame-ancestors against clickjacking. Permissions-Policy is a good addition.

Should I hide the Server and X-Powered-By headers?

It's worth it. They tell anyone the exact software and version you run, which makes known vulnerabilities easier to target. Removing them doesn't fix anything, but it gives less away.

Why is there no Content-Encoding header?

The checker asks for Brotli or gzip, like a browser does. If the response comes back without Content-Encoding, the server sent it uncompressed, which usually means compression is switched off at your server or CDN.

Is the HTTP header checker free?

Yes, with no signup.

Need to check more than one issue? Run our free SEO audit tool for 210 automated SEO and AI search checks, with evidence and priority fixes in a shareable report. No email or signup required.