Limited public endpoint check

HTTP Headers Checker

Check selected response headers for one public HTTP or HTTPS endpoint. MyIPScan uses a HEAD request with strict public-target checks, redirect limits, timeouts, and no response body proxying.

By: Katia Belokon · Updated June 2026

Check headers

Enter one public URL to start.

Technical response details (optional)

Direct answer

HTTP Headers Checker: answer first

View selected HTTP response headers for one public URL with SSRF protections and clear limitations. Use the result as an observable public-signal check with stated limitations, not as an absolute guarantee.

Last updated June 9, 2026

B2B diagnostic report model

Website and domain diagnostics

Public website checks connect HTTPS/SSL, redirects, headers, DNS, robots/sitemap, canonical/noindex, structured data, and social preview signals.

SummaryStart with a plain-language status for the public target.

Top issuesPrioritize the few findings that need attention first.

What passedShow expected public signals without turning them into a certification.

What needs reviewSeparate limited, unavailable, and review-worthy signals.

Why it mattersExplain the business, delivery, crawl, or implementation impact.

Recommended fixesPoint to the DNS, hosting, email, CMS, or SEO owner who can act.

What this tool cannot checkThis is not a vulnerability scan, penetration test, malware scan, uptime monitor, or full security audit.

Client-safe copyClient-safe copy should keep issue summaries and recommended fixes while avoiding raw headers, cookies, tokens, credentials, and oversized payloads.

Monitoring beta (optional)Optional monitoring beta can track public changes in SSL, redirects, headers, DNS, robots/sitemap, canonical/noindex, and metadata after a target is approved.

Client-safe report

Share findings without leaking raw technical material

Use Safe Copy or this page's summary when sending results to a client, vendor, developer, or support team. Raw headers, credentials, tokens, cookies, private addresses, email local-parts, and oversized payloads should stay out of client-facing copy.

Review Safe Copy Ask about monitoring beta

About this checkWhat it checks, what it cannot, and how to read it

Check my website/domain

What this checks

Public DNS, HTTP, HTTPS, certificate, redirect, header, IP/ASN, or domain configuration signals.

Limits

What this cannot check

It cannot perform credentialed vulnerability testing, scan private hosts, bypass access controls, or certify complete security.

Read results

How to use the output

Treat results as review signals for this browser/session or public target. Re-test after one change, then use Safe Copy or notes that avoid raw identifiers.

Quick reference

HTTP Headers Checker: what this tool does

Checks selected response headers for one public HTTP or HTTPS endpoint.

How to use

Enter one public HTTP or HTTPS URL.
Read the final URL first: a redirect means you are looking at a different endpoint's headers.
Re-check after each hosting, CDN or reverse-proxy change.

What the result means

The result is the set of selected response headers /api/http-headers received for one HEAD request to that endpoint, after a DNS preflight. It describes what that URL sent back at that moment, to the edge location that made the request.

Limitations

One endpoint per request, HEAD only. Response bodies are never downloaded.
Headers vary by path, method, region, bot policy and cache state, so one URL does not characterise a whole site.
This is a header listing. It is not a vulnerability scan and it does not judge whether a header's value is right.

HTTP Headers Checker — Common Questions

What are HTTP response headers and why do they matter?

HTTP response headers are metadata sent by a server with every response — before the actual page content. They tell the browser how to handle the response: what content type it is, how long to cache it, whether to allow cross-origin requests, what security policies to enforce, and how redirects should work. Checking response headers is essential for debugging caching issues, redirect chains, CORS problems, and security misconfigurations.

What headers should every website have?

Essential: Content-Type (with charset), Strict-Transport-Security (HSTS, forces HTTPS), X-Content-Type-Options: nosniff (prevents MIME sniffing), X-Frame-Options (prevents clickjacking), Content-Security-Policy (controls resource loading). Useful: Cache-Control (caching rules), Referrer-Policy (controls referrer leakage), Permissions-Policy (restricts browser APIs). See our Security Headers Checker for a dedicated security-header audit.

How do I check headers for a URL behind a redirect?

This tool follows redirects and shows the final response headers. Use our Redirect Checker to see every hop in the redirect chain, including the headers returned at each step. This is useful for diagnosing redirect loops, checking that HSTS is set on the final destination, or verifying that a CDN is serving the correct cache headers.

What does Cache-Control: no-store mean vs no-cache?

no-store means the browser must not save any part of the response — not in memory, not on disk. Used for sensitive pages (banking, health). no-cache means the browser can cache the response but must revalidate with the server before using it (sends a conditional request). max-age=0, must-revalidate has the same effect as no-cache. For static assets (images, CSS, JS) you want long max-age with cache-busting file names instead.

Next checks and references

Website Security ToolsParent hub for this tool category.Security Headers CheckerInformational security-header presence check.SSL Certificate CheckerCertificate transparency expiry and SAN check.Redirect CheckerLimited redirect chain checker.Robots.txt CheckerCrawler directives and sitemap declaration check.Sitemap CheckerXML sitemap and sitemap index validator.Relevant guideBackground reading for interpreting this result.MethodologyHow MyIPScan labels confidence, limits, and safe-copy outputs.