# HTTP Headers Checker

Fetch a public http(s) URL from our server and return the redirect chain hop by hop (status, headers, server IP, timing), loop and downgrade detection, and an analysis of the final response: graded security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), cache semantics, cookie flags, server software and CDN. A bare host tries https first, then http. Follows at most 10 redirects; private and internal addresses are refused. Requests go out over HTTP/1.1 (the httpVersion field), so it does not show which protocol a site supports: an h3 entry in the alt-svc header means it offers HTTP/3. Response bodies are never kept.

**Not for:** Certificates (use ssl_check), DNS records (use dns_lookup) or page content.

- Tool id: `http-headers`
- Category: web
- Execution: network
- MCP tool `http_headers` at https://lookupowl.com/mcp
- REST `GET https://lookupowl.com/api/v1/tools/http-headers` (or POST a JSON body)
- OpenAPI: https://lookupowl.com/api/openapi.json

## Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `url` | string | yes |  | URL or host to fetch, e.g. https://example.com/page or example.com (https is tried first, then http). Only public http(s) addresses on ports 80, 443, 8080 and 8443 are fetched; private, loopback and internal addresses are refused. max length 2048 |
| `method` | "GET" \| "HEAD" | no | `"GET"` | GET shows what a browser receives; HEAD asks for headers only (a few servers answer it differently). |
| `followRedirects` | boolean | no | `true` | Follow redirects (up to 10 hops, each checked again) or stop at the first response. |

## Output

Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields:

| Field | Type | Description |
|---|---|---|
| `url` | string | The URL that was requested (canonical form). |
| `method` | "GET" \| "HEAD" |  |
| `finalUrl` | string |  |
| `status` | integer | Status of the last response. min -9007199254740991, max 9007199254740991 |
| `statusText` | string |  |
| `ok` | boolean | The last response is 2xx. |
| `hops` | object[] | Every response in order; the last one is the final response. |
| `totalMs` | number |  |
| `redirects` | object |  |
| `security` | object |  |
| `caching` | object |  |
| `cookies` | object[] | Cookies set by the final response: names and flags only, never values. |
| `server` | object |  |
| `content` | object |  |
| `issues` | object[] |  |
| `notes` | string[] |  |

## Examples

### Headers of example.com

```json
{"url":"https://example.com/","method":"GET","followRedirects":true}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/http-headers?followRedirects=true&method=GET&url=https%3A%2F%2Fexample.com%2F'
```

Web page: https://lookupowl.com/http-headers-checker?q=https%3A%2F%2Fexample.com%2F

### Follow the redirect from http to https

```json
{"url":"http://github.com","method":"GET","followRedirects":true}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/http-headers?followRedirects=true&method=GET&url=http%3A%2F%2Fgithub.com%2F'
```

Web page: https://lookupowl.com/http-headers-checker?q=http%3A%2F%2Fgithub.com%2F

### Headers only (HEAD)

```json
{"url":"https://www.cloudflare.com/","method":"HEAD","followRedirects":true}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/http-headers?followRedirects=true&method=HEAD&url=https%3A%2F%2Fwww.cloudflare.com%2F'
```

Web page: https://lookupowl.com/http-headers-checker?q=https%3A%2F%2Fwww.cloudflare.com%2F&method=HEAD

### Stop at the first redirect

```json
{"url":"http://google.com","method":"GET","followRedirects":false}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/http-headers?followRedirects=false&method=GET&url=http%3A%2F%2Fgoogle.com%2F'
```

Web page: https://lookupowl.com/http-headers-checker?q=http%3A%2F%2Fgoogle.com%2F&followRedirects=false

## Web pages

- https://lookupowl.com/http-headers-checker
- https://lookupowl.com/redirect-checker

## Limits and caching

- Cost: 3 units for a live lookup, 1 unit for a cached one. Budgets are per network and published in the `RateLimit` response headers.
- Cache: results are kept for 120 s. Add `fresh=true` (MCP argument or query parameter) to look again; it costs 3 units per unit and is limited to 10 per hour.
- Timeout: 16 s.

## Related tools

- [Security Headers Checker](https://lookupowl.com/tools/security-headers.md): Grade a site's HTTP security headers from A+ to F, with what each one does and the exact header to add.
- [SSL Certificate Checker](https://lookupowl.com/tools/ssl-checker.md): Check a site's SSL/TLS certificate: days until it expires, whether it is trusted, matches the host and has a complete chain.
- [DNS Lookup](https://lookupowl.com/tools/dns-lookup.md): Look up A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, DS and DNSKEY records from a public resolver or the authoritative nameserver.
- [WHOIS Lookup](https://lookupowl.com/tools/whois-lookup.md): Registrar, creation and expiry dates, status codes, nameservers and DNSSEC for any domain, from RDAP with WHOIS fallback.
- [Who Hosts This Website](https://lookupowl.com/tools/website-hosting.md): Find the web host or CDN, DNS provider and email provider behind a domain, with the evidence, and whether the origin is hidden.

## Guide: HTTP headers checker

Follow a URL hop by hop and see every status code, redirect and header along the way.

### What this tool shows

Before a page appears, the server sends a status code and a set of headers: what kind of response it is, how long to cache it, which security rules apply, which cookies to set and where to go next. Browsers hide this by default. The HTTP headers checker makes the request from LookupOwl's server, follows any redirects, and shows each hop's status, the IP that answered, how long it took and every header.

Use it to debug caching and CDN (content delivery network) behaviour, confirm that security headers are really being sent, find out why a URL redirects somewhere unexpected, or see what a crawler or API client gets without installing anything.

### How to use it

1. **Enter a URL**: Type `https://example.com/page` or just `example.com`. A bare host is tried over HTTPS first, then over plain HTTP if HTTPS cannot be reached at all. Only public addresses on ports 80, 443, 8080 and 8443 are fetched.
2. **Pick a method**: In More options, choose GET or HEAD. GET shows what a browser would receive. HEAD asks the server for the headers only, which is lighter for large files, though a few servers answer it differently. You can also switch off Follow redirects there to see just the first response. Either way, LookupOwl reads only the headers and never downloads the page.
3. **Read each hop**: If the URL redirects, every step appears with its own status and headers, ending at the final response. LookupOwl follows up to 10 redirects. For a closer look at chains and loops, use the [redirect checker](https://lookupowl.com/redirect-checker).

> **In Claude, ChatGPT or Cursor** With the LookupOwl MCP server connected, ask “Does example.com send HSTS and a Content-Security-Policy?” The assistant calls `http_headers` and reads the graded result.

```bash
# The same check from a terminal
curl -sIL https://example.com
curl -s -o /dev/null -D - https://example.com
```

### The headers worth knowing

| Header | What it does | What to look for |
|---|---|---|
| `Cache-Control` | Sets how long browsers and CDNs may store the response. | `no-store` disables caching, `public, max-age=31536000, immutable` suits fingerprinted assets, and `private` keeps it out of shared caches. |
| `Content-Type` | Media type and character set. | `text/html; charset=utf-8` for pages. A wrong type breaks rendering. |
| `Content-Encoding` | The compression used. | `br` or `gzip` on text responses saves bandwidth. |
| `Strict-Transport-Security` | Tells browsers to use HTTPS only (HSTS). | A `max-age` of at least 15552000 (180 days) rates good, and a year is the usual advice. Add `includeSubDomains` if every subdomain supports HTTPS. |
| `Content-Security-Policy` | Restricts what the page may load or run. | That it exists, and that its script sources are not a wildcard or `'unsafe-inline'`. |
| `X-Frame-Options` | Stops other sites from framing the page (clickjacking). | `DENY` or `SAMEORIGIN`, or a CSP `frame-ancestors` rule instead. |
| `X-Content-Type-Options` | Stops browsers guessing the content type. | `nosniff`. |
| `Referrer-Policy`, `Permissions-Policy` | Limit what is leaked to other sites and which browser features are allowed. | Deliberate values, not defaults. |
| `Set-Cookie` | Creates cookies. | `Secure`, `HttpOnly` and `SameSite` attributes. |
| `Location` | Where a redirect goes. | The target URL, and whether it is the one you meant. |
| `Server`, `X-Powered-By` | The software that answered. | Version numbers you may prefer not to expose. |
| `Vary`, `ETag`, `Age` | Cache keys, validators and the age of a CDN's copy. | Why two visitors get different cached copies. |
| `Alt-Svc` | Advertises other ways to reach the site, such as HTTP/3. | `h3` in the value means the site offers HTTP/3. |

LookupOwl also grades the final response on six security headers, weighted by importance: Content-Security-Policy 30 points, HSTS 25, frame protection 15, `X-Content-Type-Options` 15, `Referrer-Policy` 10 and `Permissions-Policy` 5. Each is rated good, ok, weak or missing, the total becomes a score out of 100, and the score becomes a grade from A+ (97 and up) down to F (under 40). Treat the grade as a checklist rather than a verdict, because a header can be absent for a good reason. If the last response is a redirect, for example because you switched off Follow redirects, there is no grade: its headers belong to the page it points to.

The result also summarises caching (`max-age`, `no-store`, validators), lists each cookie's name and flags, and names the server software or CDN when the headers give it away. The Cookies tab never shows cookie values, but the raw `Set-Cookie` lines do, so skim a result before you paste it into a public thread.

- **Status classes.** 2xx means success, 3xx a redirect, 4xx a problem with the request (404 missing, 403 forbidden, 429 too many requests) and 5xx a server failure (500, 502, 503, 504).
- **Protocol.** Each hop says it was fetched over HTTP/1.1, because that is the only version LookupOwl speaks, so it is not a sign of what the site supports. When the final response offers HTTP/2 or HTTP/3 in its `Alt-Svc` header, the answer at the top says so. The questions below say more.
- **Timing.** Each hop's time runs from the start of the request to the arrival of the response headers, so it includes the DNS lookup, the connection and the TLS handshake. It is one measurement from one place: a hint, not a benchmark.

### Problems you can diagnose

- **Stale content after a deploy.** Look at `Cache-Control`, `Age` and `ETag`. A CDN may still hold the old copy.
- **HSTS missing.** Without it, a first visit over HTTP can be intercepted before the redirect to HTTPS.
- **Cookies without flags.** Session cookies that lack `Secure` or `HttpOnly` are easier to steal or leak.
- **A different result from my browser.** The request comes from LookupOwl's server, not your device, and sites may serve different content to different clients or countries.
- **403 or 429 from the site.** Some sites block automated requests. That is the site's choice, and it is useful to know.
- **An error instead of headers.** The checker verifies certificates, so an `https://` address whose certificate fails shows an error, not headers. A bare host is retried over plain HTTP, and the result says what failed. Use the [SSL checker](https://lookupowl.com/ssl-checker) to see what is wrong.
- **Cannot connect.** The address may be blocked (private or loopback), on a port other than 80, 443, 8080 or 8443, or the server may be down. Check its [DNS records](https://lookupowl.com/dns-lookup).

### How the fetch works

LookupOwl looks up the hostname once, checks that every address it returns is public, then connects to that exact IP so DNS cannot be swapped underneath it. It sends one GET or HEAD request per hop, with a user agent that names LookupOwl and points to the About page, and follows redirects itself, re-checking each new host. It reads the headers and hangs up, so no page is downloaded. Requests to private, loopback or reserved addresses are refused. Fresh checks of any one server or domain are limited to 30 a minute across all callers, so the tool cannot be used to flood a site. Results are cached for two minutes, and Check again fetches a fresh one.

### Standards

- **RFC 9110**: HTTP semantics, methods, status codes and header fields. **RFC 9111**: caching.
- **RFC 9112**: HTTP/1.1, the version LookupOwl speaks. **RFC 9113 and RFC 9114**: HTTP/2 and HTTP/3. **RFC 7838**: `Alt-Svc`.
- **RFC 6797**: HTTP Strict Transport Security. **RFC 6265**: cookies.
- **IANA HTTP Field Name Registry**: the list of registered header names.

### Frequently asked questions

**How do I check the HTTP headers of a website?**

Enter its URL above. You get the status code and every response header, including those of each redirect on the way, plus a security grade and a caching summary for the final response. You also see which IP answered and how long each hop took.

**What is the difference between GET and HEAD?**

GET asks the server for the full response, while HEAD asks for the headers only. The headers are normally identical, but some servers differ, especially for dynamic pages. LookupOwl reads only the headers either way, so GET is the better default: it shows what a browser would get.

**Why is my security grade low when my site works fine?**

The grade only counts which protective headers you send, not whether the site works. Missing headers cost points because browsers cannot use protections you never switched on, and a Content-Security-Policy and HSTS weigh the most. Add what suits your site and ignore items that do not apply, such as framing rules for a page meant to be embedded.

**Why are my security headers missing from the result?**

They may be set on the application but stripped by a proxy, set only on some paths, or set only for certain content types. Check the exact URL, including the final one after redirects, because the grade applies to the last response.

**Can I check a page behind a login?**

No. Every request is anonymous: LookupOwl sends none of your cookies or credentials and no custom headers, only a fixed user agent, `Accept: */*` and `Accept-Encoding`. For pages behind a login, use `curl` or your browser's developer tools, where you can send your own cookies and see exactly what comes back.

**How can I tell if a site uses HTTP/2 or HTTP/3?**

Not from this page, because LookupOwl always speaks HTTP/1.1. For HTTP/2, the [SSL checker](https://lookupowl.com/ssl-checker) shows the protocol the server picks (`h2`) on port 443. For HTTP/3, the answer at the top shows an Offers HTTP/3 badge when the `Alt-Svc` header says so, or you can watch the protocol column in your browser's network panel.

**Is it available to AI assistants?**

Yes, through the `http_headers` tool on the free MCP server and REST API. No key is needed, and fresh checks of any one site are limited to 30 a minute across all callers. The assistant gets the hops, the security grade and the caching summary as structured data.