Free tool
Check a site’s HTTP headers
See every response header a URL sends, which security headers are missing, how it’s cached, and where the time goes, checked live from Stockholm.
Checked from Stockholm, Sweden · Free, no sign-up
- Try
Questions
Which security headers should a website send?
Strict-Transport-Security keeps browsers on HTTPS, Content-Security-Policy limits where scripts and styles may come from (and with frame-ancestors, who may frame the page), X-Content-Type-Options: nosniff stops browsers guessing file types, Referrer-Policy limits what the next site learns, and Permissions-Policy turns off features such as the camera. X-Frame-Options still matters for older browsers.
What do DNS, connect, TLS, waiting and download mean?
DNS is looking up the address, connect is opening the TCP connection, TLS is the encryption handshake, waiting is the time to the first byte while the server works on the request, and download is reading the answer. We measure them on a fresh connection to the final URL; redirects before it are shown as their own part of the bar.
Why are cookie values hidden?
A cookie a server hands our checker can be a real session, so we show each cookie’s name and attributes, such as Secure, HttpOnly and SameSite, and replace its value with “…”.
Does the checker follow redirects?
Yes, up to 5, and it shows each hop with its status code and the Location header as the server wrote it. The headers and timings are those of the page at the end.
How do I get alerted when a header disappears?
An HTTP monitor on Uptimecheck can check a response header on every request, for example that Strict-Transport-Security exists or that Cache-Control contains max-age, and alerts you when the check fails.
Let Uptimecheck keep watching
This free tool answers one question at a time. In Uptimecheck, the same work runs on its own and alerts you when something needs attention.
More free tools
All tools- Redirect checker Enter a URL to see every redirect hop with its status code, where it ends up and whether HTTP goes to HTTPS, checked live from Stockholm. Open tool
- SSL certificate checker See whether a site’s certificate is valid, when it expires, who issued it, which names it covers and the full chain, checked from Stockholm. Open tool
- HTTP status codes What each status code means in plain English, what usually causes it, what to do about it, and whether an uptime check counts it as down. Open tool
Downtime is obsolete.
Set up your first monitor in under a minute, or look around the live demo first.
14-day free trial · No credit card required