HandyBench

HTTP Headers Checker

See the redirect chain, response headers and security header coverage.

This check runs through this site's own server, so it works for any public URL — no CORS or browser restrictions.

How to use the HTTP Headers Checker

  1. 1 Enter a URL and click Check headers.
  2. 2 Follow the redirect chain hop by hop, with the status code at each step.
  3. 3 Review the final response's headers and the security header pass/miss summary.

How the redirect chain is traced

The server asks for your URL with a GET request and does not follow redirects automatically. Instead it records each response, and if the status is 3xx with a Location header, it resolves that location against the current URL and requests it as the next hop. The body is never read, only the status line and headers.

  • Hop limit. The trace stops after 10 requests. If the chain is still redirecting, the result is labelled "truncated at 10", which usually means a loop or a badly configured canonical-host rule.
  • SSRF guard. Every hop is validated before it is fetched. Only http and https on ports 80, 443 and 8080 are allowed, and localhost, .local and .internal names, private and link-local IP ranges, embedded credentials and numeric IP encodings are refused. A redirect that points at a blocked target shows "Redirect blocked" rather than being followed.
  • Timeout. Each hop gets 10 seconds.

Reading a typical chain

This is an illustrative result for a site that has both a protocol and a host redirect:

301  http://example.com/        -> redirects to next hop
301  https://example.com/       -> redirects to next hop
200  https://www.example.com/

Three requests, two redirects. Each hop adds a round trip before the page can start loading, so the fix is to send the first URL straight to the final one with a single 301. The redirect generator writes the Apache and Nginx rules for that.

The security header checklist

The checker looks at the final hop only and marks six headers PASS when present and MISS when absent. It tests for presence, not for a good value, so a weak policy still passes.

HeaderWhat it does
Strict-Transport-SecurityTells browsers to use HTTPS only for a stated period (RFC 6797)
Content-Security-PolicyLimits where scripts, styles and frames may load from
X-Content-Type-OptionsValue nosniff stops browsers guessing a file's MIME type
X-Frame-OptionsRestricts whether the page can be embedded in a frame
Referrer-PolicyControls how much of the URL is sent to other sites
Permissions-PolicySwitches browser features such as camera and geolocation on or off

Things to keep in mind

  • The request comes from a data-centre server with a bot user agent. Some sites and firewalls answer that differently from a normal browser, for example with a 403 or a challenge page, so the headers you see may not be the ones a visitor gets.
  • Header names are shown in lowercase because HTTP header names are case-insensitive.
  • A Cache-Control value of no-store on a page you expected to be cached is a common cause of slow repeat visits.
  • If the final status is 404 or 5xx, the chain still displays. Check the last badge before reading anything into the headers.

Once the final URL is clean, confirm its canonical tag with the canonical checker.

Examples

  • ▸ http://example.com redirecting 301 to https://example.com and then 301 to https://www.example.com shows three hops: two redirects and a final 200. A single direct redirect is faster.
  • ▸ A final response with no Strict-Transport-Security header shows a red MISS for HSTS, while a present X-Content-Type-Options: nosniff shows a green PASS with its value.
  • ▸ A redirect that points at an internal address such as http://localhost/ is not followed and is reported as "Redirect blocked".

Frequently asked questions

Why does the redirect chain matter for SEO?

Each extra hop adds latency and, historically, could dilute link equity. Aim for a single, direct 301 redirect straight to the final URL rather than a chain of several.

What do headers like Strict-Transport-Security and Content-Security-Policy do?

Strict-Transport-Security (HSTS) forces browsers to use HTTPS on future visits. Content-Security-Policy restricts which scripts and resources a page may load, reducing the risk of XSS. X-Frame-Options and X-Content-Type-Options block clickjacking and MIME-sniffing attacks respectively.

Why doesn't a well-known site show all these security headers?

Some sites apply security controls at a CDN or WAF layer that strips or rewrites headers, or simply have not adopted every header — a missing header is a hardening opportunity, not necessarily proof of a vulnerability.

Do missing security headers hurt search rankings?

They are not a direct ranking factor the way HTTPS itself is, but they are a widely used trust and security signal, and a normal part of a technical SEO or security audit.

How many redirects will the checker follow?

Up to 10 responses, with 10 seconds in total for the whole chain. If the chain is still redirecting after that, the result is marked "truncated at 10", which usually indicates a redirect loop. Every hop is checked against the same safety rules, so redirects to private or internal addresses are refused.

Does a PASS mean the header is configured well?

No. The checker only tests whether each of the six headers is present on the final response. A Content-Security-Policy that allows everything, or an HSTS max-age of a few seconds, still shows PASS, so read the value shown beside it.

Related guides

Related tools

Developer

Redirect Generator

Build .htaccess and Nginx redirect rules.
SEO

Canonical Tag Checker

Verify a page's canonical tag and catch duplicate-content mistakes.
SEO

Broken Link Checker

Find dead links on any page before your visitors — or Google — do.
SEO

DNS Lookup

Look up any domain's DNS records in one click.