Inspect any URL's response headers, TLS certificate, request timing waterfall, and body metadata. Get automated security and performance analysis with actionable fix recommendations.
Quick Presets
Conditional Requests (Caching Test)
Origin & Referrer (CORS / Hotlink Testing)
Authentication & Session
Not saved to browser storageCustom Headers
Add custom headers to test X-Forwarded-For, X-Real-IP, X-Custom-Header, etc.
Written by Ishan Karunaratne · Last reviewed:
The HTTP Header Checker makes a single request to your URL and captures everything that happens during the connection: DNS resolution, TCP handshake, TLS negotiation, and the server's response. It then runs a 20+ point automated analysis across security headers, performance metrics, TLS configuration, and response quality — grading the overall result and flagging issues with specific fix instructions.
Every issue includes copy-pasteable server configurations for Nginx, Apache, and Cloudflare so you can fix problems immediately. Security-relevant response headers are annotated with colored badges for instant identification. The timing waterfall uses color-coded thresholds so you can spot bottlenecks at a glance.
Every HTTP response carries far more information than the visible web page. The status code tells you whether the server handled the request successfully or encountered an error. Response headers carry security policies, caching directives, server software details, and content negotiation metadata. The TLS certificate tells you who vouches for the server's identity and how long that trust is valid. The timing breakdown reveals exactly where time is being spent — in DNS resolution, TCP handshaking, TLS negotiation, or server processing.
Together, these signals let you diagnose performance bottlenecks, verify security configurations, audit header policies, and confirm that certificates are valid and correctly configured — all from a single request.
Time to resolve the hostname to an IP address using DNS. A cached result returns in under 1 ms. An uncached query to an authoritative nameserver typically takes 20–80 ms. Use a low DNS TTL during migrations and a higher TTL (3600 s or more) for stable production records.
Time to complete the three-way TCP handshake (SYN, SYN-ACK, ACK). This is primarily determined by network round-trip time (RTT) between the inspection server and your origin. Serving from a CDN edge node close to users dramatically reduces this value.
Time for SSL/TLS negotiation — key exchange, certificate verification, and cipher agreement. TLS 1.3 (current standard) requires only one round trip vs two for TLS 1.2, making it meaningfully faster. TLS session resumption and 0-RTT in TLS 1.3 can reduce this to near zero for repeat connections.
Time from the request being sent until the first byte of the response arrives. This captures server-side processing: application code execution, database queries, template rendering, and cache lookups. This is the metric you control most directly through application optimisation and caching strategy. Google's recommended threshold is under 800 ms, with excellent performance under 200 ms.
A TLS certificate binds a domain name to a public key and is signed by a Certificate Authority (CA) that browsers trust. The inspector shows the full certificate chain details so you can verify the certificate is from a trusted issuer, covers the correct hostnames via Subject Alternative Names (SANs), and has sufficient time before expiry.
Certificates are automatically flagged if they are expired, not yet valid, self-signed (not signed by a trusted CA), or have a hostname mismatch (the domain you requested is not listed in the SANs). Any of these conditions will cause browsers to show a security warning and block users.
Modern certificates from public CAs like Let's Encrypt, DigiCert, and Sectigo are valid for 90 days to 1 year. Set up automatic certificate renewal at least 30 days before expiry to avoid service interruptions.
Grade your security headers A+ to F and generate server configurations for Nginx, Apache, and Cloudflare.
Trace and visualize redirect chains with SEO analysis, timing, and bot testing.
Look up A, AAAA, CNAME, MX, TXT, and NS records for any domain.
Check if a URL is flagged for malware or phishing across 17 security vendors.
Audit 70+ on-page SEO factors including meta tags, headings, images, links, and structured data.