HTTP header checker
Enter an address and this tool requests it, follows any redirects, and lists every response header the final page sends. It checks for six common security headers, whether the HTML is compressed, and whether an X-Robots-Tag header is keeping the page out of search.
It’s for makers checking a new host, CDN or framework setup. Headers are invisible in the browser window, so problems like a leftover noindex can go unnoticed for weeks.
Free with a ShipScroll account.
How to use the HTTP Header Checker
- Enter the page address. Headers can differ between pages, so check the ones that matter.
- Press Check headers. Redirects are followed, and the final page’s headers are shown.
- Read the findings first, especially any X-Robots-Tag error.
- Use the security table to see which headers are missing and what each one does.
The six security headers we check
| Header | What it does |
|---|---|
| Strict-Transport-Security | Makes browsers use HTTPS for your site |
| Content-Security-Policy | Limits where scripts and styles can load from |
| X-Content-Type-Options | Stops browsers guessing a file’s type |
| X-Frame-Options | Stops your pages being framed by other sites |
| Referrer-Policy | Controls what your address reveals when people follow links away |
| Permissions-Policy | Switches off browser features you don’t use |
The header that can hide a page from Google
X-Robots-Tag works like a robots meta tag, but in the response headers. X-Robots-Tag: noindex keeps a page out of search results even when the HTML looks fine. It’s often set on staging servers and copied to production by mistake, and it’s the first thing worth ruling out when a page won’t index.
What a missing header means
A missing security header isn’t a hack, and it doesn’t affect rankings. It means the browser isn’t given an extra layer of protection. Strict-Transport-Security and X-Content-Type-Options are quick wins on almost any site. A Content-Security-Policy takes more care, because a strict one can break scripts you rely on.
Questions
Why are some headers different from what my host shows?
A CDN or proxy in front of your server can add, change or remove headers. This tool shows what a visitor actually receives, after all of those layers.
Do security headers help SEO?
Not directly: they protect visitors rather than affect rankings. X-Robots-Tag is the exception, because it controls whether a page can be indexed at all.
Why does it say my HTML isn’t compressed?
There was no Content-Encoding header on the HTML, so it was sent uncompressed. Turning on gzip or Brotli on your server or CDN usually shrinks HTML a lot and makes pages load faster.
Is it safe to paste any address?
Yes. The tool only requests public addresses and never sends cookies or logins. It refuses private and internal addresses such as localhost.
Related tools
- Redirect CheckerFollow every hop from an address to the page it ends on, with each status code.
- Meta Tags CheckerSee the title, description, canonical and share tags a page actually serves.
- Website Down CheckerCheck whether a site is down for everyone, or just for you.