How to Check the HTTP Headers of a Website (Or a Whole List of Them)
To check the HTTP headers of a website, request its page and read the response headers. The bulk HTTP header checker does this for up to 100 sites a run (500 after a Google sign-in), and each row shows the final status after redirects, the Server and X-Powered-By values, cache headers and the platform a header names. Download the results as CSV.
Headers are the part of a web response you do not see on the page. They tell you what answered, whether it was cached, and which CDN or host sits in front. For a list of sites, that makes them a quick way to sort by platform.
Step 1: paste the sites
Paste domains, email addresses or URLs, one per line. The domain is taken from each. Up to 100 are accepted a run without an account, and up to 500 after a free Google sign-in, with no card.
Step 2: run the check
Each home page is requested once over HTTPS, then over HTTP if HTTPS does not answer, following up to five redirects. Ten sites are checked per request. The headers you see are those of the final response, and the row gives the redirect count.
The request identifies itself honestly as SimpleVerifier, sends no cookies and reads at most 128 KB of the body. It goes only to public addresses on ports 80 and 443. RFC 9110 defines how header fields are sent.
Step 3: read the row
| Field | What it tells you |
|---|---|
| Status and redirects | The final HTTP status and how many redirects it took to get there |
| Server | The software or service that answered, if the site shares it |
| X-Powered-By | The framework or runtime, if the site shares it. Many sites remove it |
| Content type and encoding | Whether the page is HTML and how it was compressed |
| Cache-control, ETag, Last-Modified | How the page may be cached and when it last changed |
| Via | A proxy or CDN in the path |
| Strict-Transport-Security, X-Frame-Options, Content-Security-Policy | A few security headers, shown when set |
| Platform | A CDN or host named by one header, with the header that gave it away |
Server and X-Powered-By are optional, and many sites remove or change them, so a blank is common and not a fault. For Set-Cookie, the tool shows only that a cookie is set, never the value.
How the platform is named
From one header at a time, and the row says which. A cf-ray header points to Cloudflare, x-amz-cf-id to Amazon CloudFront, x-vercel-id to Vercel, x-nf-request-id to Netlify, x-fastly-request-id to Fastly and x-azure-ref to Azure Front Door, among a few more. A Server value naming the platform, such as cloudflare, counts too.
That is a guess from a header, not a lookup of the site's hosting. A site behind a CDN shows the CDN rather than its origin, and one that strips these headers shows nothing. To find the company that hosts a domain, use the website host checker and read how to find which company hosts a website.
Why a site shows 403 here but loads in your browser
Some sites answer 403 Forbidden or 429 Too Many Requests to anything that is not a browser. Others block cloud servers or certain countries. The row still shows the headers of that refusal, and they often name the CDN that blocked it, which is itself useful. Open the site in a browser to confirm any row that matters.
Domains that resolve only to private or reserved addresses are never fetched, by design. The tool also sends at most 60 requests a minute to any one host across all users.
What to use it for
- Sorting a lead list by platform. Filter the CSV to sites behind Cloudflare, or to those showing a particular framework, to segment outreach.
- Auditing a portfolio. Spot sites missing cache headers or still answering over plain HTTP.
- Checking a migration. Confirm the new host is answering by looking for its platform header. Pair it with auditing redirects after a site migration.
- Finding dead sites. A timeout or error status is a hint a domain is down; the bulk website status checker is built for that, and our guide to checking if a list of websites is online covers it.
What this check cannot do
- Only the home page is requested, once. Other paths may send different headers.
- Sites that block automated or cloud traffic can answer 403 or time out while loading fine in a browser.
- A platform label is a guess from one header, and CDNs hide the origin.
- It lists headers; it does not grade them. For a graded view of the security ones, use the security headers checker.
- Domains that resolve only to private or reserved addresses are not fetched.
If you are emailing the owners of those sites
A header scan tells you what a site runs, not whether you can reach the person behind it. Check the addresses on your list on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each address comes back valid, risky or invalid with a reason, and nothing is sent to the people on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.
Check your sites now
Paste them into the bulk HTTP header checker.
Common questions
How do I check the HTTP headers of a website?
Request the page and read the response headers. A bulk HTTP header checker does this for the home page of many sites at once and shows the final status after redirects, the Server and X-Powered-By headers, cache headers and the platform a header names, with a CSV download.
Which headers does the checker show?
Server, X-Powered-By, content type and encoding, cache-control, ETag, Last-Modified, Via, Strict-Transport-Security, X-Frame-Options and Content-Security-Policy, when the site sends them. For Set-Cookie it shows only that a cookie is set, never the value.
Can I trust the platform label?
Treat it as a hint. It comes from one header, which the row names, and sites can hide or change headers. A site behind a CDN shows the CDN, not its origin.
Why does a site return 403 here but load in my browser?
Some sites refuse anything that is not a browser, or block cloud servers or certain countries. The row still shows the headers of that refusal, which often name the CDN that blocked it.
Is this the same as a security headers check?
No. This tool lists what a site sends. The security headers checker grades the security-related ones; a few appear in both.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.