HTTP Headers Lookup

About HTTP Headers Lookup

HTTP Headers Lookup requests a URL and lists every response header alphabetically along with the status code, the final address after redirects and the total time. It is the tool for debugging caching, security headers, content types and redirect chains without opening browser developer tools.

How to use it

1. Enter a full address in the URL box, for example https://example.com. If you leave off the scheme, https:// is added.
2. Press Fetch Headers. Our server sends a HEAD request and follows redirects one hop at a time.
3. Check the Response card for the status line, Final URL and Total Time in milliseconds.
4. If the address redirected, read the Redirect Chain table to see each From, Status and To step.
5. Scan the Response Headers table for values like cache-control, content-type, server and strict-transport-security.

A redirecting address

http://example.com

Redirect Chain lists each hop with its 3xx status and target. Response shows the final status such as 200 OK plus the Final URL, and Response Headers lists every header sorted by name.

When to use it

• Confirming that an http address redirects with a 301 to https and not a 302.
• Checking cache-control and etag values after changing your CDN settings.
• Seeing which security headers a site sends before you audit it more deeply.
• Tracing a long redirect chain that slows down a marketing link.

Questions about HTTP Headers Lookup

Why HEAD instead of GET?

HEAD returns only the headers, so nothing large is downloaded. A few servers answer HEAD differently from GET or return 405, so a header you see in a browser might be missing here.

How many redirects will it follow?

Up to 10 hops, and the entire walk must finish inside 10 seconds. Each hop is checked to make sure it points to a public host, so a redirect into a private network stops the walk.

Where do the request headers come from?

They come from our server, not from your browser. That means cookies and login sessions are never included, and a page that needs authentication reports its logged-out response.

Is my URL stored or shared?

The address is sent to our server to make the request and is not passed anywhere except the target site. Avoid pasting URLs that contain private tokens in the query string.

What is the rate limit?

About 20 requests per minute per visitor. That is comfortable for interactive debugging, but scripted bulk checks will be refused.

Related tools

• IP LookupLook up information about an IP address
• DNS LookupLook up DNS records for a domain
• WHOIS LookupLook up WHOIS information for a domain
• SSL LookupLook up SSL certificate information for a domain
• Reverse IP LookupFind domains hosted on an IP address
• CDN detectorIdentify which CDN or WAF fronts a site from its response headers and CNAME chain.