Inspect the status code and headers a server returns, including redirects, caching and security policy. The request runs from our server, so the result does not depend on your browser or your location.
How it works
- 1Enter the full URL, including https://.
- 2Check the status: 200 means success, 301 and 302 mean a redirect.
- 3Review security headers such as HSTS, CSP and X-Frame-Options.
Which headers actually matter?
Content-Security-Policy limits injection attacks, Strict-Transport-Security forces HTTPS, X-Content-Type-Options prevents MIME sniffing, and Cache-Control defines what may be stored and for how long.
Why does my site redirect endlessly?
Redirect loops usually come from contradictory rules between a proxy and the application, or from a forced HTTPS rule applied to a request that already terminates as HTTP internally.