HTTP Codes and HeadersHTTP response header checker
Paste the status line and headers of a response. The checker explains each header and points out problems.
How to get the headers
- In a browser: open developer tools (F12), choose the Network tab, reload, click the first request and copy the Response Headers.
- With curl:
curl -I https://your-site.example/prints the status line and headers (the-Ioption sends a HEAD request, which some servers answer a little differently than a GET). - For a real GET:
curl -i https://your-site.example/prints the headers and the page.
Paste only the status line and headers. Do not paste cookies or tokens that belong to a login of yours: the headers you paste stay in your browser, but it is good practice not to share them anywhere.
What the checker does
It reads the status line, explains every header in plain words and prints notes. For example, it tells you when a 401 answer lacks WWW-Authenticate or a 301 lacks Location (the RFCs require them), when a cookie has no Secure, HttpOnly or SameSite, and when an HTML page has none of the common security headers. These are notes, not a verdict.
Does the checker contact my site?
No. It only reads the text you paste. It cannot fetch other sites, because browsers do not let a page read headers of another site without its permission.
Why is my header not explained?
The checker knows about thirty common headers. For others, see the IANA field registry or the documentation of the software that sends it.
This is an independent guide. It is not connected with the IETF, IANA, any browser maker or any company named here. Meanings were checked against the RFC texts on 14 November 2026. Responses shown were recorded on 14 November 2026 from a small test server on the author's own computer.