HTTP header checker
Paste an address to see the HTTP headers the page sends: the status code, the headers that tell search engines what to do with it, and the security headers browsers act on. Each one Check Engine checks gets a verdict, and redirects on the way are followed and listed.
| Header | Value |
|---|
Free, no sign-up required. Nothing to install, and the headers are read once, not kept.
- Type a domain or paste the full address of one page.
- Press Show headers.
- Read the verdicts first, then the raw values underneath.
You will see:
- The final status code and the address that sent it, after any redirects
- The headers that matter for search and security, each with its value
- Check Engine's verdict on HSTS, X-Content-Type-Options, Referrer-Policy and any noindex in X-Robots-Tag
This reads the headers of one response. Check Engine reads them for your whole site along with 99 checks on what each page contains.
That was one response, read once. Check Engine runs 99 checks across your whole site, ranked by what to fix first, each with where it is and the change to make. The free download shows your score and the top problem in full.
$59once
For Macs with Apple silicon or Intel, macOS 12 or later, and 64-bit Windows
30-day refund, no conditions.
Intel Mac? Get the Intel version
How do I check my HTTP headers?
Paste the address above. To see them yourself, there are two ways:
- In the browser. Open the developer tools, choose the Network tab, reload the page, click the first request and read Response Headers.
- In a terminal.
curl -sI https://yourbusiness.com/prints the status line and every header. Add-Lto follow redirects.
Which headers matter
| Header | What it does |
|---|---|
X-Robots-Tag | Search engine instructions for files that have no HTML, such as PDFs. A
noindex here keeps the page out of search however the page itself is tagged. |
Link | Can carry a canonical address for a file, the same way a canonical tag does in a page. |
Cache-Control | How long browsers and CDNs may reuse the response before asking again. |
Strict-Transport-Security | Tells browsers to use HTTPS for the site from now on. |
X-Content-Type-Options | nosniff stops a browser guessing a file's type from its contents. |
Referrer-Policy | How much of the page's address is passed on when a visitor follows a link away. |
Content-Security-Policy | Which scripts and sources the page may load. |
How many well-known sites send them
On 6 November 2026, Check Engine read the homepages of the 110 well-known sites in its measurement sample. 76 ended on an HTTPS page and are counted here; sites that refused the request are left out.
| Header | Missing |
|---|---|
| Strict-Transport-Security | 9 of 75 |
| X-Content-Type-Options | 27 of 76 |
| Referrer-Policy (as a header) | 46 of 76 |
| Content-Security-Policy | 27 of 76 |
Homepages, measured 6 November 2026. HSTS is not counted for a site on a domain the browsers already force to HTTPS. No site is named.
Referrer-Policy is the one most often left out as a header, and it can also be set with a meta tag in the page, which this table does not count. Check Engine's app reads both. It does not report a missing Content-Security-Policy; the row is there for reference.
$59once
For Macs with Apple silicon or Intel, macOS 12 or later, and 64-bit Windows
Priced in US dollars. Checkout shows your currency and any local tax.
On a Mac? Get the Mac version.
On your phone?
Launch price: $29.50 once, through 30 November. From 1 December: $59. Buy applies the code FOUNDINGDOCKET for you; if the checkout shows $59, enter it under ‘Have a discount code?’.
Screaming Frog is $279 a year. Ahrefs plans with Site Audit run $129–$449 a month. Check Engine is $59 once. Screaming Frog’s price read 4 November 2026, Ahrefs’ 9 November 2026.
30 days, no conditions, no questions asked. Refund policy
Related
Common questions
How do I check my HTTP headers?
Paste the address into the checker, or open the browser's developer tools, choose Network, reload and read Response Headers. In a terminal, curl -sI followed by the address prints them.
Do I need an HSTS header?
On most domains, yes: it makes browsers use HTTPS from the first visit on. On a domain the browsers already force to HTTPS, such as .app or .dev, it adds nothing.
Can an HTTP header stop a page being indexed?
Yes. X-Robots-Tag: noindex keeps a page out of search even when the page itself has no noindex tag.