Skip to content
Convertto

HTTP Header Checker — Security Grade, Redirect Chain and Cookies

Follow every redirect, grade the security headers and read the cookie and caching settings.

To check HTTP headers, enter a URL and every redirect is followed and timed before the final response is graded. Six security headers are scored by what each one actually prevents, with the reason attached, and the cookie flags, caching and compression settings are read alongside them. The whole redirect chain is shown, because a slow first byte is often three hops rather than a slow server.

Uses a server
Privacy
Uses a server — the address you enter is sent to perform the lookup
Redirects
Followed and timed, up to ten hops
Grading
Weighted by what each header prevents, not by how easy it is to add
Cost
Free, unlimited, no sign-up

Frequently asked questions

Which security headers matter most?

Strict-Transport-Security and Content-Security-Policy do the heavy lifting, which is why they carry the most weight in the grade. X-Content-Type-Options: nosniff is a one-line win with no downside, and CSP frame-ancestors (or X-Frame-Options) is what prevents clickjacking.

Why does my grade drop even though I have a CSP?

A policy that allows unsafe-inline or unsafe-eval re-opens most of what CSP exists to close, so it scores half marks. Nonces or hashes for the scripts you genuinely need are the way to earn the full weight.

Why are the timings different from my browser?

Each hop is requested from the edge rather than from your connection, so these are server response times without your latency, DNS or TLS handshake. Use them to compare hops against each other, not as a measure of what a visitor experiences.

What should a session cookie have set?

Secure so it never travels over plain HTTP, HttpOnly so JavaScript cannot read it, and SameSite=Lax or Strict so it does not ride along on cross-site requests. The cookie panel flags each of the three separately for every cookie the response sets.

Why does the redirect chain matter?

Every redirect is a full round trip before anything renders, and a chain that starts on plain http exposes that first request to interception no matter how good the final response is. Collapsing three hops into one is a real and measurable win.

How to use the http header checker

  1. 1Enter a URL — redirects are followed automatically.
  2. 2Read the letter grade, then the row-by-row reasons behind it.
  3. 3Check the chain for hops that drop to plain HTTP.
  4. 4Review cookie flags and Cache-Control on the final response.

Sources & specifications

Embed this tool

Put the working http header checker on your own site. It runs in your visitors' browsers exactly as it does here — free, no account, nothing uploaded.

Share this tool

Related tools

HTTP Security Header AnalyserPaste response headers and get a security grade, with what is missing and why it matters.Content Security Policy GeneratorBuild a CSP header from common presets, with each directive explained.Open Graph PreviewRender your share card the way each platform really draws it, with the og:image measured.SSL Certificate CheckerOpen a real TLS handshake to any host and read the certificate it is serving right now.DNS LookupPull every DNS record for a domain at once, check SPF and DMARC, and compare four public resolvers.Email Header AnalyzerPaste raw email headers to map the delivery path, time every hop and read the SPF, DKIM and DMARC results the receiving server recorded.

Last updated

More network tools