Skip to content
LookupOwl

HTTP headers checker

Follow a URL hop by hop and see every status code, redirect and header along the way.

We follow redirects hop by hop.

More options

GET shows what a browser receives; HEAD asks for headers only (a few servers answer it differently).

Follow redirects (up to 10 hops, each checked again) or stop at the first response.

Try:

Results for design-camp.github.com

Checked live lookup748 ms

JSONCheck again

200 OK

Lands safely after 2 redirects

https://design-camp.github.com/ takes 2 redirects to settle on https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpages%2Fauth%3Fnonce%3D2e8d5545-e075-4391-a06c-f0805d423481%26page_id%3D77952115%26path%3DLw.

Total time
746ms

Slowest hop: #1 (309 ms)

The journey
  1. 1
    302 Moved Temporarily
    https://design-camp.github.com/
    2606:50c0:8001::153fetched over HTTP/1.1
    → Redirects to https://github.com/pages/auth?nonce=2e8d5545-e075-4391-a06c-f0805d423481&page_id=77952115&path=Lw
    309 ms · slowest
  2. 2
    302 Found
    https://github.com/pages/auth?nonce=2e8d5545-e075-4391-a06c-f0805d423481&page_id=77952115&path=Lw
    140.82.121.3fetched over HTTP/1.1
    → Redirects to https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpages%2Fauth%3Fnonce%3D2e8d5545-e075-4391-a06c-f0805d423481%26page_id%3D77952115%26path%3DLw
    209 ms
  3. 3
    200 OK
    https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpages%2Fauth%3Fnonce%3D2e8d5545-e075-4391-a06c-f0805d423481%26page_id%3D77952115%26path%3DLw
    140.82.121.3fetched over HTTP/1.1
    226 ms

3 hops: 302 → 302 → 200.

Security headers
A

5 of 6 checks pass

Caching
Never stored

Not cacheable: no-store forbids browsers and CDNs from keeping a copy.

Server
github.com
  • 1 of 3 cookies lack recommended flags (Secure, HttpOnly, SameSite); see the cookies list.
Response headers19
Response of hop 3 · 200 OK
HeaderValue
dateSun, 15 Nov 2026 20:54:36 GMT
content-typetext/html; charset=utf-8
varyX-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, X-GitHub-Client-Version, Sec-Fetch-Site,Accept-Encoding, Accept, X-Requested-With
cache-controlno-store
etagW/"6d3219f4f64775fb61a8f97584fa2ec3"
strict-transport-securitymax-age=31536000; includeSubdomains; preload
x-frame-optionsdeny
x-content-type-optionsnosniff
x-xss-protection0
referrer-policyorigin-when-cross-origin, strict-origin-when-cross-origin
content-security-policydefault-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net productionresultssa30.blob.core.windows.net productionresultssa31.blob.core.windows.net productionresultssa32.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-…
servergithub.com
content-encodinggzip
accept-rangesbytes
set-cookie_gh_sess=nLi6MgyWC%2FxFAuk8cXeqz%2B5FoKJE8rq4BR4OEuLrBqotd1bieA%2Fv9rYd5JHFLZL8M5lCnpW53umdEaZU9FHC5Aw0RdBGGC8wLLiereqbhvsFZubtZQo5vq6aqYmKzqccqjzV%2FvjZh6VoyOsV8ZQEQ9%2Bgot9P%2B0bwZoFAV2uqbFGl1Zc1etYqcCFu50khY2ydTMxV0UqzO7rAuQf74%2FpgH%2B3tOFS%2FtqjobLqkOKb4rhKCujKgXOE0L%2Fs7hpeV5XJWU0y3gObwKQ8obCs3Zh9GCA%3D%3D--ZbI2hYK%2FKlj2qo1r--LeOh7LxkQNaX9FEM0rYq5w%3D%3D; path=/; HttpOnly; secure; SameSite=Lax _octo=GH1.1.2020189703.1794776076; expires=Mon, 15 Nov 2027 20:54:36 GMT; domain=.github.com; path=/; secure; SameSite=Lax logged_in=no; expires=Mon, 15 Nov 2027 20:54:36 GMT; domain=.github.com; path=/; HttpOnly; secure; SameSite=Lax
x-github-request-idD9FC:202BA9:1134156D:17EE46B2:6AFA1C0C
x-github-edge-regionfra
connectionclose
transfer-encodingchunked
Headers of hop 1 · 302 · 21
HeaderValue
connectionclose
content-length138
serverGitHub.com
content-typetext/html
set-cookie__Host-gh_pages_session=2e8d5545-e075-4391-a06c-f0805d423481; Secure; path=/; HttpOnly
cache-controlprivate, no-store
x-pages-private1
x-origin-cacheno-store
locationhttps://github.com/pages/auth?nonce=2e8d5545-e075-4391-a06c-f0805d423481&page_id=77952115&path=Lw
x-github-request-id8E5A:9D4E3:6D60C06:6E17651:6AFA1BFF
x-github-edge-regionfra
fastly-restarts1
accept-rangesbytes
dateSun, 15 Nov 2026 20:54:36 GMT
via1.1 varnish
x-served-bycache-par-lfpg1960057-PAR
x-cacheMISS
x-cache-hits0
x-timerS1794776076.999255,VS0,VE227
varyAccept-Encoding
x-fastly-request-id6f6044417ebbf03597c87f1734cd7b8e84466d00
Headers of hop 2 · 302 · 17
HeaderValue
dateSun, 15 Nov 2026 20:54:36 GMT
content-typetext/html; charset=utf-8
varyX-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, X-GitHub-Client-Version,Accept-Encoding, Accept, X-Requested-With
locationhttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpages%2Fauth%3Fnonce%3D2e8d5545-e075-4391-a06c-f0805d423481%26page_id%3D77952115%26path%3DLw
cache-controlno-cache
strict-transport-securitymax-age=31536000; includeSubdomains; preload
x-frame-optionsdeny
x-content-type-optionsnosniff
x-xss-protection0
referrer-policyorigin-when-cross-origin, strict-origin-when-cross-origin
content-security-policydefault-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net productionresultssa30.blob.core.windows.net productionresultssa31.blob.core.windows.net productionresultssa32.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-…
servergithub.com
set-cookie_gh_sess=RkWO0FLBTEQACf8OBwEYYPlStDdf%2BasAqU%2Fa86DiszcoNXUuCpgnmlivdkuSiZYz4m90TRNwKCT4NR4Gx%2BGkTJlLibdesJlKzy9Id%2FPM7RvPOsALB1bWEJ49d%2BS4rhAEQdTgZw2Pb6t2wjyKY7zYL4eGyO0EHD0j0tQtBnOrEPPNgj6M1ktSTIwMAnofhi8wFpkyd8lGWKCCysyuRcxVHw4oJMYVuEMgCV%2BNuybZ%2Fj60GHxSpmxQN6I%2FD68XtBouzm%2Fkr4Wiwq%2Bw9Jvb1JHMHg%3D%3D--k6GMd3vp9r7TkrzO--W%2Bi8wv9NHlKNCimyeIHHiQ%3D%3D; path=/; HttpOnly; secure; SameSite=Lax _octo=GH1.1.2065088574.1794776076; expires=Mon, 15 Nov 2027 20:54:36 GMT; domain=.github.com; path=/; secure; SameSite=Lax logged_in=no; expires=Mon, 15 Nov 2027 20:54:36 GMT; domain=.github.com; path=/; HttpOnly; secure; SameSite=Lax
content-length0
x-github-request-idD9F6:30D6F7:10C41699:175D9028:6AFA1C0C
x-github-edge-regionfra
connectionclose
Security6

These six headers tell browsers how to treat the page. A missing one is a chance to tighten things up, not a fault in itself. Score: 95 out of 100.

HeaderRatingValueWhat it means
Strict-Transport-SecurityGoodmax-age=31536000; includeSubdomains; preloadHSTS is enabled for 365 days. includeSubDomains and preload are set: the site can be added to browsers' preload lists.
Content-Security-PolicyGooddefault-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-…A Content-Security-Policy restricts script sources.
X-Frame-OptionsGooddenyFraming is limited (DENY), which blocks clickjacking.
X-Content-Type-OptionsGoodnosniffMIME sniffing is disabled.
Referrer-PolicyGoodorigin-when-cross-origin, strict-origin-when-cross-originstrict-origin-when-cross-origin keeps full URLs from leaking to other sites.
Permissions-PolicyMissing–No Permissions-Policy: powerful browser features stay available to any embedded content.
Caching

Not cacheable: no-store forbids browsers and CDNs from keeping a copy.

Cache-Control
no-store
ETag
✓ Yes
Vary
X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, X-GitHub-Client-Version, Sec-Fetch-Site,Accept-Encoding, Accept, X-Requested-With
Cookies3
NameSecureHttpOnlySameSiteLastsWorth a look
_gh_sess✓ Yes✓ YeslaxThis visit–
_octo✓ Yes– NolaxPersistentmissing HttpOnly: scripts on the page can read it
logged_in✓ Yes✓ YeslaxPersistent–
Server
Software
github.com
Content type
text/html; charset=utf-8
Compression
gzip
Structured result (JSON) · 18 KB
{
  "url": "design-camp.github.com",
  "method": "GET",
  "finalUrl": "https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpages%2Fauth%3Fnonce%3D2e8d5545-e075-4391-a06c-f0805d423481%26page_id%3D77952115%26path%3DLw",
  "status": 200,
  "ok": true,
  "hops": [
    {
      "url": "https://design-camp.github.com/",
      "status": 302,
      "headers": {
        "connection": "close",
        "content-length": "138",
        "server": "GitHub.com",
        "content-type": "text/html",
        "set-cookie": "__Host-gh_pages_session=2e8d5545-e075-4391-a06c-f0805d423481; Secure; path=/; HttpOnly",
        "cache-control": "private, no-store",
        "x-pages-private": "1",
        "x-origin-cache": "no-store",
        "location": "https://github.com/pages/auth?nonce=2e8d5545-e075-4391-a06c-f0805d423481&page_id=77952115&path=Lw",
        "x-github-request-id": "8E5A:9D4E3:6D60C06:6E17651:6AFA1BFF",
        "x-github-edge-region": "fra",
        "fastly-restarts": "1",
        "accept-ranges": "bytes",
        "date": "Sun, 15 Nov 2026 20:54:36 GMT",
        "via": "1.1 varnish",
        "x-served-by": "cache-par-lfpg1960057-PAR",
        "x-cache": "MISS",
        "x-cache-hits": "0",
        "x-timer": "S1794776076.999255,VS0,VE227",
        "vary": "Accept-Encoding",
        "x-fastly-request-id": "6f6044417ebbf03597c87f1734cd7b8e84466d00"
      },
      "ms": 309,
      "statusText": "Moved Temporarily",
      "location": "https://github.com/pages/auth?nonce=2e8d5545-e075-4391-a06c-f0805d423481&page_id=77952115&path=Lw",
      "ip": "2606:50c0:8001::153",
      "httpVersion": "1.1"
    },
    {
      "url": "https://github.com/pages/auth?nonce=2e8d5545-e075-4391-a06c-f0805d423481&page_id=77952115&path=Lw",
      "status": 302,
      "headers": {
        "date": "Sun, 15 Nov 2026 20:54:36 GMT",
        "content-type": "text/html; charset=utf-8",
        "vary": "X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, X-GitHub-Client-Version,Accept-Encoding, Accept, X-Requested-With",
        "location": "https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpages%2Fauth%3Fnonce%3D2e8d5545-e075-4391-a06c-f0805d423481%26page_id%3D77952115%26path%3DLw",
        "cache-control": "no-cache",
        "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
        "x-frame-options": "deny",
        "x-content-type-options": "nosniff",
        "x-xss-protection": "0",
        "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
        "content-security-policy": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net productionresultssa30.blob.core.windows.net productionresultssa31.blob.core.windows.net productionresultssa32.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com wss://production-copilot-host-centralus.webpubsub.azure.com wss://production-copilot-host-centralus-02.webpubsub.azure.com wss://production-copilot-host-westus.webpubsub.azure.com wss://production-copilot-host-westus3.webpubsub.azure.com wss://production-copilot-host-eastasia.webpubsub.azure.com wss://production-copilot-host-austriaeast.webpubsub.azure.com api.github.com/cmc_internal/api/; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com *.googleusercontent.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.co…",
        "server": "github.com",
        "set-cookie": "_gh_sess=RkWO0FLBTEQACf8OBwEYYPlStDdf%2BasAqU%2Fa86DiszcoNXUuCpgnmlivdkuSiZYz4m90TRNwKCT4NR4Gx%2BGkTJlLibdesJlKzy9Id%2FPM7RvPOsALB1bWEJ49d%2BS4rhAEQdTgZw2Pb6t2wjyKY7zYL4eGyO0EHD0j0tQtBnOrEPPNgj6M1ktSTIwMAnofhi8wFpkyd8lGWKCCysyuRcxVHw4oJMYVuEMgCV%2BNuybZ%2Fj60GHxSpmxQN6I%2FD68XtBouzm%2Fkr4Wiwq%2Bw9Jvb1JHMHg%3D%3D--k6GMd3vp9r7TkrzO--W%2Bi8wv9NHlKNCimyeIHHiQ%3D%3D; path=/; HttpOnly; secure; SameSite=Lax\n_octo=GH1.1.2065088574.1794776076; expires=Mon, 15 Nov 2027 20:54:36 GMT; domain=.github.com; path=/; secure; SameSite=Lax\nlogged_in=no; expires=Mon, 15 Nov 2027 20:54:36 GMT; domain=.github.com; path=/; HttpOnly; secure; SameSite=Lax",
        "content-length": "0",
        "x-github-request-id": "D9F6:30D6F7:10C41699:175D9028:6AFA1C0C",
        "x-github-edge-region": "fra",
        "connection": "close"
      },
      "ms": 209,
      "statusText": "Found",
      "location": "https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpages%2Fauth%3Fnonce%3D2e8d5545-e075-4391-a06c-f0805d423481%26page_id%3D77952115%26path%3DLw",
      "ip": "140.82.121.3",
      "httpVersion": "1.1"
    },
    {
      "url": "https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpages%2Fauth%3Fnonce%3D2e8d5545-e075-4391-a06c-f0805d423481%26page_id%3D77952115%26path%3DLw",
      "status": 200,
      "headers": {
        "date": "Sun, 15 Nov 2026 20:54:36 GMT",
        "content-type": "text/html; charset=utf-8",
        "vary": "X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, X-GitHub-Client-Version, Sec-Fetch-Site,Accept-Encoding, Accept, X-Requested-With",
        "cache-control": "no-store",
        "etag": "W/\"6d3219f4f64775fb61a8f97584fa2ec3\"",
        "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
        "x-frame-options": "deny",
        "x-content-type-options": "nosniff",
        "x-xss-protection": "0",
        "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
        "content-security-policy": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net productionresultssa30.blob.core.windows.net productionresultssa31.blob.core.windows.net productionresultssa32.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com wss://production-copilot-host-centralus.webpubsub.azure.com wss://production-copilot-host-centralus-02.webpubsub.azure.com wss://production-copilot-host-westus.webpubsub.azure.com wss://production-copilot-host-westus3.webpubsub.azure.com wss://production-copilot-host-eastasia.webpubsub.azure.com wss://production-copilot-host-austriaeast.webpubsub.azure.com api.github.com/cmc_internal/api/ browser.events.data.microsoft.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com *.googleusercontent.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com; script-src github.githubassets.com 'sha256-6AKuI+c…",
        "server": "github.com",
        "content-encoding": "gzip",
        "accept-ranges": "bytes",
        "set-cookie": "_gh_sess=nLi6MgyWC%2FxFAuk8cXeqz%2B5FoKJE8rq4BR4OEuLrBqotd1bieA%2Fv9rYd5JHFLZL8M5lCnpW53umdEaZU9FHC5Aw0RdBGGC8wLLiereqbhvsFZubtZQo5vq6aqYmKzqccqjzV%2FvjZh6VoyOsV8ZQEQ9%2Bgot9P%2B0bwZoFAV2uqbFGl1Zc1etYqcCFu50khY2ydTMxV0UqzO7rAuQf74%2FpgH%2B3tOFS%2FtqjobLqkOKb4rhKCujKgXOE0L%2Fs7hpeV5XJWU0y3gObwKQ8obCs3Zh9GCA%3D%3D--ZbI2hYK%2FKlj2qo1r--LeOh7LxkQNaX9FEM0rYq5w%3D%3D; path=/; HttpOnly; secure; SameSite=Lax\n_octo=GH1.1.2020189703.1794776076; expires=Mon, 15 Nov 2027 20:54:36 GMT; domain=.github.com; path=/; secure; SameSite=Lax\nlogged_in=no; expires=Mon, 15 Nov 2027 20:54:36 GMT; domain=.github.com; path=/; HttpOnly; secure; SameSite=Lax",
        "x-github-request-id": "D9FC:202BA9:1134156D:17EE46B2:6AFA1C0C",
        "x-github-edge-region": "fra",
        "connection": "close",
        "transfer-encoding": "chunked"
      },
      "ms": 226,
      "statusText": "OK",
      "ip": "140.82.121.3",
      "httpVersion": "1.1"
    }
  ],
  "totalMs": 746,
  "redirects": {
    "count": 2,
    "loop": false,
    "tooMany": false,
    "notFollowed": false,
    "httpsUpgrade": false,
    "downgrade": false,
    "crossDomain": false,
    "chain": [
      {
        "from": "https://design-camp.github.com/",
        "to": "https://github.com/pages/auth?nonce=2e8d5545-e075-4391-a06c-f0805d423481&page_id=77952115&path=Lw",
        "status": 302
      },
      {
        "from": "https://github.com/pages/auth?nonce=2e8d5545-e075-4391-a06c-f0805d423481&page_id=77952115&path=Lw",
        "to": "https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpages%2Fauth%3Fnonce%3D2e8d5545-e075-4391-a06c-f0805d423481%26page_id%3D77952115%26path%3DLw",
        "status": 302
      }
    ]
  },
  "security": {
    "score": 95,
    "grade": "A",
    "checks": [
      {
        "id": "hsts",
        "header": "Strict-Transport-Security",
        "weight": 25,
        "present": true,
        "value": "max-age=31536000; includeSubdomains; preload",
        "rating": "good",
        "message": "HSTS is enabled for 365 days. includeSubDomains and preload are set: the site can be added to browsers' preload lists."
      },
      {
        "id": "csp",
        "header": "Content-Security-Policy",
        "weight": 30,
        "present": true,
        "value": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.gith…",
        "rating": "good",
        "message": "A Content-Security-Policy restricts script sources."
      },
      {
        "id": "frame-options",
        "header": "X-Frame-Options",
        "weight": 15,
        "present": true,
        "value": "deny",
        "rating": "good",
        "message": "Framing is limited (DENY), which blocks clickjacking."
      },
      {
        "id": "content-type-options",
        "header": "X-Content-Type-Options",
        "weight": 15,
        "present": true,
        "value": "nosniff",
        "rating": "good",
        "message": "MIME sniffing is disabled."
      },
      {
        "id": "referrer-policy",
        "header": "Referrer-Policy",
        "weight": 10,
        "present": true,
        "value": "origin-when-cross-origin, strict-origin-when-cross-origin",
        "rating": "good",
        "message": "strict-origin-when-cross-origin keeps full URLs from leaking to other sites."
      },
      {
        "id": "permissions-policy",
        "header": "Permissions-Policy",
        "weight": 5,
        "present": false,
        "rating": "missing",
        "message": "No Permissions-Policy: powerful browser features stay available to any embedded content."
      }
    ]
  },
  "caching": {
    "noStore": true,
    "noCache": false,
    "private": false,
    "public": false,
    "immutable": false,
    "mustRevalidate": false,
    "cacheability": "no-store",
    "summary": "Not cacheable: no-store forbids browsers and CDNs from keeping a copy.",
    "cacheControl": "no-store",
    "etag": true,
    "vary": "X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, X-GitHub-Client-Version, Sec-Fetch-Site,Accept-Encoding, Accept, X-Requested-With"
  },
  "cookies": [
    {
      "name": "_gh_sess",
      "secure": true,
      "httpOnly": true,
      "persistent": false,
      "issues": [],
      "path": "/",
      "sameSite": "lax"
    },
    {
      "name": "_octo",
      "secure": true,
      "httpOnly": false,
      "persistent": true,
      "issues": [
        "missing HttpOnly: scripts on the page can read it"
      ],
      "domain": ".github.com",
      "path": "/",
      "sameSite": "lax"
    },
    {
      "name": "logged_in",
      "secure": true,
      "httpOnly": true,
      "persistent": true,
      "issues": [],
      "domain": ".github.com",
      "path": "/",
      "sameSite": "lax"
    }
  ],
  "server": {
    "versionDisclosed": false,
    "software": "github.com"
  },
  "content": {
    "type": "text/html; charset=utf-8",
    "encoding": "gzip"
  },
  "issues": [
    {
      "severity": "warning",
      "code": "COOKIE_FLAGS",
      "message": "1 of 3 cookies lack recommended flags (Secure, HttpOnly, SameSite); see the cookies list."
    }
  ],
  "notes": [],
  "statusText": "OK"
}

Next step

What this tool shows

Before a page appears, the server sends a status code and a set of headers: what kind of response it is, how long to cache it, which security rules apply, which cookies to set and where to go next. Browsers hide this by default. The HTTP headers checker makes the request from LookupOwl's server, follows any redirects, and shows each hop's status, the IP that answered, how long it took and every header.

Use it to debug caching and CDN (content delivery network) behaviour, confirm that security headers are really being sent, find out why a URL redirects somewhere unexpected, or see what a crawler or API client gets without installing anything.

How to use it

  1. Enter a URLType https://example.com/page or just example.com. A bare host is tried over HTTPS first, then over plain HTTP if HTTPS cannot be reached at all. Only public addresses on ports 80, 443, 8080 and 8443 are fetched.
  2. Pick a methodIn More options, choose GET or HEAD. GET shows what a browser would receive. HEAD asks the server for the headers only, which is lighter for large files, though a few servers answer it differently. You can also switch off Follow redirects there to see just the first response. Either way, LookupOwl reads only the headers and never downloads the page.
  3. Read each hopIf the URL redirects, every step appears with its own status and headers, ending at the final response. LookupOwl follows up to 10 redirects. For a closer look at chains and loops, use the redirect checker.
Shell
# The same check from a terminal
curl -sIL https://example.com
curl -s -o /dev/null -D - https://example.com

The headers worth knowing

HeaderWhat it doesWhat to look for
Cache-ControlSets how long browsers and CDNs may store the response.no-store disables caching, public, max-age=31536000, immutable suits fingerprinted assets, and private keeps it out of shared caches.
Content-TypeMedia type and character set.text/html; charset=utf-8 for pages. A wrong type breaks rendering.
Content-EncodingThe compression used.br or gzip on text responses saves bandwidth.
Strict-Transport-SecurityTells browsers to use HTTPS only (HSTS).A max-age of at least 15552000 (180 days) rates good, and a year is the usual advice. Add includeSubDomains if every subdomain supports HTTPS.
Content-Security-PolicyRestricts what the page may load or run.That it exists, and that its script sources are not a wildcard or 'unsafe-inline'.
X-Frame-OptionsStops other sites from framing the page (clickjacking).DENY or SAMEORIGIN, or a CSP frame-ancestors rule instead.
X-Content-Type-OptionsStops browsers guessing the content type.nosniff.
Referrer-Policy, Permissions-PolicyLimit what is leaked to other sites and which browser features are allowed.Deliberate values, not defaults.
Set-CookieCreates cookies.Secure, HttpOnly and SameSite attributes.
LocationWhere a redirect goes.The target URL, and whether it is the one you meant.
Server, X-Powered-ByThe software that answered.Version numbers you may prefer not to expose.
Vary, ETag, AgeCache keys, validators and the age of a CDN's copy.Why two visitors get different cached copies.
Alt-SvcAdvertises other ways to reach the site, such as HTTP/3.h3 in the value means the site offers HTTP/3.

LookupOwl also grades the final response on six security headers, weighted by importance: Content-Security-Policy 30 points, HSTS 25, frame protection 15, X-Content-Type-Options 15, Referrer-Policy 10 and Permissions-Policy 5. Each is rated good, ok, weak or missing, the total becomes a score out of 100, and the score becomes a grade from A+ (97 and up) down to F (under 40). Treat the grade as a checklist rather than a verdict, because a header can be absent for a good reason. If the last response is a redirect, for example because you switched off Follow redirects, there is no grade: its headers belong to the page it points to.

The result also summarises caching (max-age, no-store, validators), lists each cookie's name and flags, and names the server software or CDN when the headers give it away. The Cookies tab never shows cookie values, but the raw Set-Cookie lines do, so skim a result before you paste it into a public thread.

  • Status classes. 2xx means success, 3xx a redirect, 4xx a problem with the request (404 missing, 403 forbidden, 429 too many requests) and 5xx a server failure (500, 502, 503, 504).
  • Protocol. Each hop says it was fetched over HTTP/1.1, because that is the only version LookupOwl speaks, so it is not a sign of what the site supports. When the final response offers HTTP/2 or HTTP/3 in its Alt-Svc header, the answer at the top says so. The questions below say more.
  • Timing. Each hop's time runs from the start of the request to the arrival of the response headers, so it includes the DNS lookup, the connection and the TLS handshake. It is one measurement from one place: a hint, not a benchmark.

Problems you can diagnose

  • Stale content after a deploy. Look at Cache-Control, Age and ETag. A CDN may still hold the old copy.
  • HSTS missing. Without it, a first visit over HTTP can be intercepted before the redirect to HTTPS.
  • Cookies without flags. Session cookies that lack Secure or HttpOnly are easier to steal or leak.
  • A different result from my browser. The request comes from LookupOwl's server, not your device, and sites may serve different content to different clients or countries.
  • 403 or 429 from the site. Some sites block automated requests. That is the site's choice, and it is useful to know.
  • An error instead of headers. The checker verifies certificates, so an https:// address whose certificate fails shows an error, not headers. A bare host is retried over plain HTTP, and the result says what failed. Use the SSL checker to see what is wrong.
  • Cannot connect. The address may be blocked (private or loopback), on a port other than 80, 443, 8080 or 8443, or the server may be down. Check its DNS records.

How the fetch works

LookupOwl looks up the hostname once, checks that every address it returns is public, then connects to that exact IP so DNS cannot be swapped underneath it. It sends one GET or HEAD request per hop, with a user agent that names LookupOwl and points to the About page, and follows redirects itself, re-checking each new host. It reads the headers and hangs up, so no page is downloaded. Requests to private, loopback or reserved addresses are refused. Fresh checks of any one server or domain are limited to 30 a minute across all callers, so the tool cannot be used to flood a site. Results are cached for two minutes, and Check again fetches a fresh one.

Standards

  • RFC 9110: HTTP semantics, methods, status codes and header fields. RFC 9111: caching.
  • RFC 9112: HTTP/1.1, the version LookupOwl speaks. RFC 9113 and RFC 9114: HTTP/2 and HTTP/3. RFC 7838: Alt-Svc.
  • RFC 6797: HTTP Strict Transport Security. RFC 6265: cookies.
  • IANA HTTP Field Name Registry: the list of registered header names.

Questions people ask

How do I check the HTTP headers of a website?

Enter its URL above. You get the status code and every response header, including those of each redirect on the way, plus a security grade and a caching summary for the final response. You also see which IP answered and how long each hop took.

What is the difference between GET and HEAD?

GET asks the server for the full response, while HEAD asks for the headers only. The headers are normally identical, but some servers differ, especially for dynamic pages. LookupOwl reads only the headers either way, so GET is the better default: it shows what a browser would get.

Why is my security grade low when my site works fine?

The grade only counts which protective headers you send, not whether the site works. Missing headers cost points because browsers cannot use protections you never switched on, and a Content-Security-Policy and HSTS weigh the most. Add what suits your site and ignore items that do not apply, such as framing rules for a page meant to be embedded.

Why are my security headers missing from the result?

They may be set on the application but stripped by a proxy, set only on some paths, or set only for certain content types. Check the exact URL, including the final one after redirects, because the grade applies to the last response.

Can I check a page behind a login?

No. Every request is anonymous: LookupOwl sends none of your cookies or credentials and no custom headers, only a fixed user agent, Accept: */* and Accept-Encoding. For pages behind a login, use curl or your browser's developer tools, where you can send your own cookies and see exactly what comes back.

How can I tell if a site uses HTTP/2 or HTTP/3?

Not from this page, because LookupOwl always speaks HTTP/1.1. For HTTP/2, the SSL checker shows the protocol the server picks (h2) on port 443. For HTTP/3, the answer at the top shows an Offers HTTP/3 badge when the Alt-Svc header says so, or you can watch the protocol column in your browser's network panel.

Is it available to AI assistants?

Yes, through the http_headers tool on the free MCP server and REST API. No key is needed, and fresh checks of any one site are limited to 30 a minute across all callers. The assistant gets the hops, the security grade and the caching summary as structured data.

Use it from AI, the API or the command line

Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is http_headers. Please be kind to the rate limits.

curl
curl "https://lookupowl.com/api/v1/tools/http-headers?q=https%3A%2F%2Fexample.com%2F"
MCP
claude mcp add --transport http lookupowl https://lookupowl.com/mcp

Description for AI agents · OpenAPI · llms.txt