# HTTP Header Checker — Security Grade, Redirect Chain and Cookies

> Follow every redirect, grade the security headers and read the cookie and caching settings.

To check HTTP headers, enter a URL and every redirect is followed and timed before the final response is graded. Six security headers are scored by what each one actually prevents, with the reason attached, and the cookie flags, caching and compression settings are read alongside them. The whole redirect chain is shown, because a slow first byte is often three hops rather than a slow server.

**URL:** https://convertto.tech/t/http-header-checker
**Category:** Network Tools (https://convertto.tech/c/network-tools)
**Privacy:** Uses a server request
**Cost:** Free, no sign-up
**Last updated:** 2026-08-01

## Key facts

- **Privacy:** Uses a server — the address you enter is sent to perform the lookup
- **Redirects:** Followed and timed, up to ten hops
- **Grading:** Weighted by what each header prevents, not by how easy it is to add
- **Cost:** Free, unlimited, no sign-up

## How to use

1. Enter a URL — redirects are followed automatically.
2. Read the letter grade, then the row-by-row reasons behind it.
3. Check the chain for hops that drop to plain HTTP.
4. Review cookie flags and Cache-Control on the final response.

## FAQ

### Which security headers matter most?

Strict-Transport-Security and Content-Security-Policy do the heavy lifting, which is why they carry the most weight in the grade. X-Content-Type-Options: nosniff is a one-line win with no downside, and CSP frame-ancestors (or X-Frame-Options) is what prevents clickjacking.

### Why does my grade drop even though I have a CSP?

A policy that allows unsafe-inline or unsafe-eval re-opens most of what CSP exists to close, so it scores half marks. Nonces or hashes for the scripts you genuinely need are the way to earn the full weight.

### Why are the timings different from my browser?

Each hop is requested from the edge rather than from your connection, so these are server response times without your latency, DNS or TLS handshake. Use them to compare hops against each other, not as a measure of what a visitor experiences.

### What should a session cookie have set?

Secure so it never travels over plain HTTP, HttpOnly so JavaScript cannot read it, and SameSite=Lax or Strict so it does not ride along on cross-site requests. The cookie panel flags each of the three separately for every cookie the response sets.

### Why does the redirect chain matter?

Every redirect is a full round trip before anything renders, and a chain that starts on plain http exposes that first request to interception no matter how good the final response is. Collapsing three hops into one is a real and measurable win.

## Sources

- [RFC 9110 — HTTP Semantics](https://www.rfc-editor.org/rfc/rfc9110) — IETF
- [RFC 6797 — HTTP Strict Transport Security](https://www.rfc-editor.org/rfc/rfc6797) — IETF
- [Content Security Policy Level 3](https://www.w3.org/TR/CSP3/) — W3C

## Related tools

- [HTTP Security Header Analyser](https://convertto.tech/t/http-header-analyser): Paste response headers and get a security grade, with what is missing and why it matters.
- [Content Security Policy Generator](https://convertto.tech/t/csp-generator): Build a CSP header from common presets, with each directive explained.
- [Open Graph Preview](https://convertto.tech/t/open-graph-preview): Render your share card the way each platform really draws it, with the og:image measured.
- [SSL Certificate Checker](https://convertto.tech/t/ssl-certificate-checker): Open a real TLS handshake to any host and read the certificate it is serving right now.
- [DNS Lookup](https://convertto.tech/t/dns-lookup): Pull every DNS record for a domain at once, check SPF and DMARC, and compare four public resolvers.
- [Email Header Analyzer](https://convertto.tech/t/email-header-analyzer): Paste raw email headers to map the delivery path, time every hop and read the SPF, DKIM and DMARC results the receiving server recorded.
- [Redirect Rule Generator](https://convertto.tech/t/redirect-generator): Generate redirect rules for Apache, Nginx, Netlify, Vercel and Next.js.
- [What Is My IP Address](https://convertto.tech/t/what-is-my-ip): Your public IPv4 and IPv6 address with the routing, registry, blocklist and VPN-leak detail behind it.