Bulk HTTP header checker: the response headers of every site on a list
In short: Paste domains and read each home page's final HTTP status, Server, X-Powered-By, content type and cache headers, with the CDN or platform a header names and the header that says so. Limit: Only the home page is requested, once. Other paths may send different headers.
A bulk HTTP header checker requests the home page of many sites and reports the response headers. Paste up to 100 domains, or 500 after a free Google sign-in, and each row shows the final status after redirects, the Server, X-Powered-By, content-type and cache-control headers, and the CDN or platform a header names. Download the results as CSV.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
acme.example answered 200 and its cf-ray header points to Cloudflare; globex.example redirected once.
- Site
- acme.example
- Server
- cloudflare
- Platform
- Cloudflare (cf-ray)
What this means for you
A platform label is a hint from one header; sites can hide or change headers.
- Status after up to five redirects
- Server, X-Powered-By, cache headers
- CDN named with its header
- Cookie values never shown; CSV out
- Headers
- HTTP
- CDN
By SimpleVerifier Team · Last updated
Auditing the websites on a lead list?
- Paste the list here as domains, URLs or email addresses: up to 100 a run, or 500 after a free Google sign-in. Filter the rows and download the CSV.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I check the HTTP headers of many websites at once?
- Paste domains, email addresses or URLs, one per line, up to 100 a run or 500 after a free Google sign-in. The domain is taken from each.
- Press Check headers. Each home page is requested once over HTTPS, then HTTP if HTTPS doesn't answer, following up to five redirects, 10 sites a request.
- Read each row: the final HTTP status, redirect count, Server and X-Powered-By values, and a platform label such as Cloudflare or Vercel with the header that gave it away.
- Open Response headers for the full short list, filter by platform or answer, and download the CSV.
Example
- You enter
- Three sites:
acme.example(behind Cloudflare),globex.example(redirects once, then answers) andinitech.example(answers 403). - You get
- acme.example: 200, platform Cloudflare from the cf-ray header, with Server and cache-control. globex.example: Redirects, with the final URL and redirect count. initech.example: HTTP error 403, with the headers of that refusal. Download the CSV.
- Limits
- Up to 100 a run without an account and 500 when signed in with Google, counted over a minute. 10 sites a request, one GET of each home page, at most 60 requests a minute to one host.
What does the checker request, and what does it show?
One GET / of each site's home page, over HTTPS first and plain HTTP if HTTPS fails, following up to five redirects. It reads the headers of the final response. RFC 9110 defines how header fields are sent; Server and X-Powered-By are optional and many sites remove or change them.
The request identifies itself honestly as SimpleVerifier, sends no cookies, reads at most 128 KB of the body, and goes only to public addresses on ports 80 and 443. The row shows a short list of headers: Server, X-Powered-By, content type and encoding, cache-control, ETag, Last-Modified, Via, Strict-Transport-Security, X-Frame-Options and Content-Security-Policy. For Set-Cookie it shows only that one is set, never the value.
How does it name the platform?
From one header at a time, and the row says which. A cf-ray header points to Cloudflare, x-amz-cf-id to Amazon CloudFront, x-vercel-id to Vercel, x-nf-request-id to Netlify, x-fastly-request-id to Fastly, x-azure-ref to Azure Front Door, and a few more. A Server value naming the platform, such as cloudflare, counts too.
A platform label is a guess from a header, not a lookup of the site's hosting. A site behind a CDN shows the CDN, not its origin; one that strips these headers shows nothing. For the company that hosts a domain, use the website host checker.
Why does a site show 403 here but load in my browser?
Some sites refuse requests that don't come from a browser and answer 403 Forbidden or 429 Too Many Requests to anything automated. Others block cloud servers or certain countries. The row still shows the headers of that refusal, which often name the CDN that blocked it.
Domains that resolve only to private or reserved addresses are never fetched, by design, and the tool sends at most 60 requests a minute to any one host across all users.
Who uses this tool, and for what?
- Sales researchers
- Find which companies on a list sit behind a given CDN or run a given web server.
- Agencies
- Check the headers and redirect behaviour of every client site after a migration.
- Security reviewers
- Spot servers that advertise their software and version in a Server or X-Powered-By header.
- SEO and performance teams
- See cache-control and compression headers across a set of sites in one table.
What can’t this tool tell you?
- Only the home page is requested, once. Other paths may send different headers.
- Sites that block automated or cloud traffic can answer 403 or time out while loading fine in a browser.
- A platform label is a guess from one header. CDNs hide the origin.
- Domains that resolve only to private or reserved addresses aren't fetched.
- Up to 100 sites a run without an account, 500 signed in.
Common questions
- How do I check HTTP headers for many websites?
- Paste the domains into a bulk HTTP header checker like this one. It requests each home page and shows the status and response headers, with a CSV of the results.
- Is this bulk header checker free?
- Yes. It is a free tool: up to 100 sites a run with no account, and up to 500 a run when you sign in with Google, with no card.
- Which headers does it show?
- Server, X-Powered-By, content type and encoding, cache-control, ETag, Last-Modified, Via, Strict-Transport-Security, X-Frame-Options and Content-Security-Policy, when the site sends them. For Set-Cookie it shows only that a cookie is set.
- Does it follow redirects?
- Yes, up to five. The headers shown are those of the final response, and the row gives the redirect count and the final URL.
- Can I trust the platform label?
- Treat it as a hint. It comes from one header, which the row names, and sites can hide or change headers.
- Is this the same as a security headers check?
- No. This tool lists what a site sends. The security headers checker grades the security-related ones; a few appear in both.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.