📑 HTTP Headers Checker
Check any site response headers, follow the redirect chain and audit security headers — no extension needed.
🔐 The check is performed by a 0Appz server request to the public URL you provide, with rate limiting and no storage of responses. Never check internal or private addresses.
How to use this tool
Overview
HTTP Headers Checker - Inspect Response Headers & Redirects shows exactly what a web server sends back. Enter any public URL or domain and get the full picture: the final status code, every hop of the redirect chain with its own status, the server IP, the negotiated HTTP protocol, and the complete list of response headers — server software, caching, compression, cookies, content type and more. A built-in audit checks the eight headers that matter for security hardening: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the two Cross-Origin policies, with a score you can act on. The whole report can be copied with one click for bug reports and audits. Private and internal addresses are blocked by design (anti-SSRF), results are rate-limited and cached for five minutes.Frequently asked questions
How does the headers check work? +
A 0Appz server makes a controlled request to the public URL you provide — resolving the hostname, verifying it is not a private address, following up to five redirects and reading the response headers. The body is capped at 64 KB because this is a headers tool, not a proxy. Results are cached for five minutes.
Why do some security headers show as missing? +
The audit checks eight common hardening headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the two Cross-Origin policies. A missing header is not always a vulnerability, but HSTS and X-Content-Type-Options are recommended for every site.
Can I check internal or localhost addresses? +
No — private, loopback and reserved IP ranges are blocked by design to prevent server-side request forgery (SSRF). Only publicly reachable hosts can be checked.
Does it show the redirect chain? +
Yes. Every hop is listed with its status code and URL, including relative and cross-domain locations, up to five redirects. The final status, IP and protocol are shown in the summary.