HTTP Header Checker
Fetch any URL and see its raw HTTP response headers: status code, security headers (HSTS, CSP, X-Frame-Options), caching directives, server signature, and more. Useful for auditing your own site's security posture, debugging why a CDN cache isn't behaving as expected, or checking what a target actually returns before scraping it.
Live checking is discontinued
ProxyChecker.dev no longer runs proxy checks, the API, MCP tools or paid plans. Nothing on this site tests a proxy anymore. The guides below still explain how proxy testing works and what to look for.
Need working proxies? These are the two providers we tested with:
Frequently asked questions
What security headers should a site have?
Common baseline headers are Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options, and X-Frame-Options. Missing them isn't automatically a vulnerability, but they're cheap protections most production sites should have.
Why does the same URL return different headers each time?
Load balancers can route to different backend servers, CDNs can serve from different edge nodes with different cache states, and A/B tests or feature flags can alter headers per request. Some variance is normal.
What does a Set-Cookie header without Secure or HttpOnly mean?
It means the cookie can be read by JavaScript (no HttpOnly) and sent over plain HTTP (no Secure), which increases the risk of session hijacking via XSS or network interception. This is a common finding worth flagging in a security review.
Can I check headers for a site that requires login?
This tool checks headers for the URL as an anonymous request, so pages that redirect to a login screen will show the redirect's headers, not the authenticated page's headers.