Quick answer
Enter a URL (for example http://example.com) and press “Check”: the server sends a request, follows up to 5 redirects and shows the status code of each hop (301, 302, 200, 404…), every header of the final response, an A–F grade for 6 security headers (HSTS, CSP, X-Content-Type-Options, framing protection, Referrer-Policy, Permissions-Policy) and a warning about headers that leak software versions.
What are HTTP headers?
HTTP headers are the “envelope” a server sends with every page: status code, redirects, caching, cookies, compression and security policies. You don't see them in the browser, yet they decide whether Google indexes the right URL, whether a stale cached copy is served, and whether the page is protected against XSS or clickjacking. Useful when moving from http to https, changing domains, setting up a CDN / Cloudflare, editing nginx or .htaccess, or running a basic security review.
How to check HTTP headers
- 1
Enter a full URL, such as http://example.com or https://www.example.com/page. Without http:// it is treated as https://.
- 2
Choose a method: GET behaves like a browser opening the page (default); HEAD only asks for headers, lighter but some servers answer differently.
- 3
Press “Check”. “Redirect chain” lists each hop with its status code, IP and response time.
- 4
Look at “Security header score” and read the advice for each missing or questionable header.
- 5
All headers of the final response are listed at the end; use “Copy all headers” to send them to your server admin.
Common HTTP status codes
| Code | Meaning | SEO / user impact |
|---|---|---|
| 200 OK | Page served normally | Indexed |
| 301 Moved Permanently | Permanent redirect | Use for URL, domain or http → https changes; passes SEO value to the new URL |
| 302 / 307 | Temporary redirect | Google may keep the old URL in results |
| 308 Permanent Redirect | Permanent, method preserved | Like 301 for forms / APIs |
| 304 Not Modified | Content unchanged | Browser uses its cached copy |
| 403 Forbidden | Access denied | Often a firewall, folder permission or bot blocking |
| 404 Not Found | No such page | Gradually dropped from the index |
| 410 Gone | Permanently removed | Dropped from the index faster than 404 |
| 500 / 502 / 503 / 504 | Server error / bad gateway / overloaded / timeout | Hurts rankings if it persists |
Graded security headers
| Header | Protects against | Suggested value |
|---|---|---|
| Strict-Transport-Security | Downgrade to http, eavesdropping | max-age=31536000; includeSubDomains |
| Content-Security-Policy | XSS, injected scripts | default-src 'self' (tune per site); frame-ancestors 'self' |
| X-Content-Type-Options | MIME-type sniffing | nosniff |
| X-Frame-Options / frame-ancestors | Clickjacking (framing your page) | SAMEORIGIN or frame-ancestors 'self' |
| Referrer-Policy | Leaking full URLs to other sites | strict-origin-when-cross-origin |
| Permissions-Policy | Frames / scripts using camera, mic, location | camera=(), microphone=(), geolocation=() |
Each “Good” header scores 2 points and “Review” 1 point, out of 12: A from 11, B from 9, C from 6, D from 3, otherwise F.
Worked examples
Checking the http to https redirect
Enter http://example.com: the ideal chain is 301 → https://example.com/ → 200. If you see a 302 or 2–3 hops (http → https → www → non-www), merge them into a single 301.
Google keeps showing the old URL
The chain shows a 302 instead of a 301: a temporary redirect. Change .htaccess to R=301 or nginx to return 301.
Adding security headers in nginx
Add add_header X-Content-Type-Options nosniff always; add_header Referrer-Policy strict-origin-when-cross-origin always; reload nginx and check again: the grade improves immediately.
Is the site behind a CDN?
Headers like cf-ray and server: cloudflare show the page goes through Cloudflare; x-cache and age describe the CDN cache.
Common problems
- “more than 5 redirects” or “redirect loop”.
- Often an SSL / WordPress plugin and Cloudflare both forcing https (Flexible mode). Set Cloudflare SSL to Full (strict) and redirect in one place only.
- Headers added in .htaccess don't appear.
- The server may run nginx (which ignores .htaccess), mod_headers may be off, or a CDN serves a stale copy. Check the server header and purge the CDN cache.
- HEAD and GET give different results.
- Some servers and firewalls treat HEAD differently or return 405. GET reflects what a browser actually receives.
- A hop says “blocked: target is an internal / reserved address”.
- For safety the tool never sends requests to internal IPs, localhost or reserved ranges, even when a public page redirects there.
- A new CSP breaks scripts.
- Start with Content-Security-Policy-Report-Only to see violations without blocking, then switch to an enforcing CSP.
What the tool sends, and how it stays safe
The Công Cụ Nhanh server resolves the domain, connects only if every IP is public, then sends one HTTP/1.1 request to that exact IP on port 80 or 443, reads only the headers (up to 64 KB) and closes the connection. Every redirect is re-validated from scratch, up to 5 times.
It sends no cookies, never logs in, downloads no page content and doesn't store the URLs you check; each IP may run 20 checks per 5 minutes.
Headers that leak software versions
Headers such as Server: nginx/1.18.0 or X-Powered-By: PHP/7.4 tell attackers exactly which version to look up vulnerabilities for. Hide versions with server_tokens off; in nginx, ServerTokens Prod in Apache and expose_php = Off in php.ini.
Glossary
- HTTP header
- “Name: value” lines a server sends before the page content.
- Redirect
- A 3xx response with a Location header pointing to the new address.
- HSTS
- HTTP Strict Transport Security (RFC 6797): tells browsers to use only https for the domain for max-age seconds.
- CSP
- Content Security Policy: the allowed sources for scripts, images, frames and more, limiting XSS.
- Clickjacking
- Embedding your page in a transparent iframe to trick users into clicking.
- CDN
- Content delivery network caching pages close to users (Cloudflare, BunnyCDN…).
Frequently asked questions
How can I tell if a redirect is 301 or 302?
Enter the old URL and look at “Redirect chain”: each hop shows its status code and destination.
Does an F grade mean my site is hacked?
No. The grade only reflects recommended security headers; missing them makes some attacks easier but doesn't mean a vulnerability exists.
Can it check pages behind a login?
No. It sends no cookies or passwords, so it sees exactly what a first-time visitor sees.
Does it support ports other than 80 / 443?
No. To avoid being used for port scanning it only accepts http (80) and https (443) to public IPs.
Why does my browser see something different?
Your browser may use its cache, send cookies, or get a location-specific version. The tool requests from the Công Cụ Nhanh server, with no cookies and the User-Agent CongCuNhanh-HeaderCheck/1.0.
Can I see the HTML?
No. Only headers are read, for speed and safety; page content is never downloaded.
Ratings and comments
Loading…