HTTP Headers and Redirect Checker

This tool sends one request to a URL. It then shows four views of the answer: the security report, the response headers, the redirect chain, and a comparison with an earlier report.

The security view groups the findings into Critical, Warning, Info, and Pass, and it gives a fix for each problem. It reads CSP directives, HSTS and its preload requirements, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, the three Cross-Origin-* policies, the deprecated X-XSS-Protection header, the Server and X-Powered-By values, Cache-Control on an HTML response, and the Access-Control-Allow-* headers.

The header view lists every response header, and it lists each Set-Cookie value on its own line. The redirect view lists each hop with its status, its time, and its headers. It follows at most 10 redirects, and it stops on a loop.

Enter a URL. To test CORS, set a request Origin, select a request method, and turn on CORS preflight. Then select Inspect. Select Download JSON to save the report with the time of the check, the URL, the method, and the raw header map. To see what changed, open Compare and drop an earlier report file. The comparison runs in your browser. The tool does not store your input.