HTTP Header Checker

Q: How can I check if a site sends HSTS or CSP?

Look at `security_headers` in the response: each of the six common security headers has its value or `null` when missing.

Q: Can I send a HEAD request instead of GET?

Yes, add `method=HEAD`. Some servers answer HEAD differently, so GET is the default.

Q: Are redirects followed?

Yes. The headers are those of the final response; the `redirects` array lists each intermediate URL and status.

See the HTTP status and every response header of a URL, with a summary of security headers like HSTS, CSP and X-Frame-Options.

Result

Press “Run” to see the result.

Give a public url and the API requests it (GET by default, or method=HEAD), follows redirects and returns the final URL, HTTP status, redirect chain, response time and all response headers as a lowercase key/value object. Only the headers are read; the body is not downloaded.

A security_headers object shows the value of strict-transport-security, content-security-policy, x-frame-options, x-content-type-options, referrer-policy and permissions-policy, or null when a header is missing, which makes it easy to audit a site security setup.

Requests use a 10 second timeout and at most 8 redirects; only public http/https hosts on ports 80, 443, 8080 and 8443 are allowed.

Use this in your code

curl "https://apibox.io.vn/v1/http-headers?url=https://example.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/http-headers?url=https://example.com', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/http-headers?url=https://example.com",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/http-headers?url=https://example.com');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

How can I check if a site sends HSTS or CSP?

Look at security_headers in the response: each of the six common security headers has its value or null when missing.

Can I send a HEAD request instead of GET?

Yes, add method=HEAD. Some servers answer HEAD differently, so GET is the default.

Are redirects followed?

Yes. The headers are those of the final response; the redirects array lists each intermediate URL and status.