Delimiter.live
Network & Web Tools Runs on our server Free · no account

HTTP Header Checker

The HTTP header checker requests a URL from our server and shows the status code and every response header, with a summary of the security headers a site should be sending. It also confirms whether the page is reachable at all.

Public http and https addresses on ports 80 and 443 only. Private and internal addresses are refused.

Reset

Runs on our server. Processing happens securely on our server. What you enter is sent to Delimiter.live to produce the result and is not stored in a database.

How to use the HTTP Header Checker

  1. Enter the full URL, including https://.
  2. Read the status code first — the reference tool explains any code you do not recognise.
  3. Review the response headers, then the security summary underneath.

Example

Input
https://www.delimiter.live/tools
Output
200 OK
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000

Common use cases

  • Confirming that a page returns 200 and not a redirect or an error.
  • Checking that caching headers are set the way you intended after a deploy.
  • Auditing which security headers a site sends — CSP, HSTS, X-Content-Type-Options and Referrer-Policy.
  • Diagnosing a wrong Content-Type that makes a browser download a file instead of rendering it.

Limitations and things to watch for

  • The request comes from our server, not from your browser, so headers that depend on the visitor — cookies, authentication, geolocation-based responses or CDN edge selection — may differ from what you would see.
  • Only public http and https URLs are accepted. Requests to private, loopback and link-local addresses are blocked, and the redirect chain is re-checked at every hop, to prevent the tool being used to reach internal systems.
  • The response body is not fetched or displayed; only status and headers are returned.
  • Requests time out after a few seconds. A timeout means the host was slow or unreachable from our server, not necessarily that the site is down for everyone.

Frequently asked questions

Why do the headers differ from what my browser shows?
Because the request is made by our server. Your browser sends cookies, an Accept-Language header and its own user agent, and a CDN may serve you a different edge node. Compare with your browser developer tools for a visitor-accurate view.
Which security headers should a site send?
At minimum Strict-Transport-Security on HTTPS, X-Content-Type-Options: nosniff, a Referrer-Policy, and a Content-Security-Policy. The summary flags which of these are present.
Can I check an internal or localhost URL?
No. Requests to private, loopback, link-local and other reserved address ranges are refused at every step of the redirect chain. That restriction exists to stop the tool being used to probe networks it should not reach.
Is the URL I check recorded?
It is not stored in a database. Standard access logs may contain the request, and successful responses are cached briefly to limit load on the sites being checked.

Share this tool