Free Tool
HTTP Header Checker
Fetch any site and inspect the response: status code, redirects, body size, every response header, and a checklist of the security headers that matter. No signup needed.
How it works
Three steps, no signup.
No cached data. Every check is a fresh HTTP request to the URL you name, run the moment you ask.
Enter any URL
Type a URL and run the check. We make a real HTTP request to it from our servers, following redirects the way a browser would.
We capture the response
We record the final status code, how many redirects it took to get there, the body size, and every response header the server sends back.
Read the report
You see the full set of response headers plus a checklist of the security headers (HSTS, CSP, and more), marking which are present and which are missing.
What are HTTP response headers?
Response headers are metadata your server sends with every page: the status code, content type, caching rules, cookies, and security policies. Browsers read them to decide how to handle the response, so a misconfigured header can affect performance, SEO, and security without anything looking broken.
Which security headers matter and why?
The big five are Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy. Together they force HTTPS, restrict where scripts can load from, stop MIME-type sniffing, prevent clickjacking through hidden iframes, and control how much URL data leaks to other sites. Missing them leaves well-known attack surface open.
What does HSTS (Strict-Transport-Security) do?
HSTS tells browsers to only ever connect to your site over HTTPS, for a period you specify. After the first visit, the browser upgrades every request itself and refuses insecure connections, which blocks protocol-downgrade and cookie-hijacking attacks even on hostile networks.
How do I catch header and status changes over time?
A one-off check shows you today's snapshot. Sentinel requests your pages on a schedule from multiple regions, verifies the status code and response on every run, and alerts you when something changes, so a bad deploy or a misbehaving proxy gets caught in minutes instead of weeks.
Stop checking by hand.
Sentinel watches your uptime, SSL, DNS and domains around the clock from multiple regions, and tells you the moment something needs attention.