FreeTools logo Http Headers

Use the form above. Parameters, code examples and FAQ are grouped in the documentation section below.


Description
- Tool to get list of response headers including redirect chain of a http connection.
- Limit : 30 requests per minute. Once reached subsequent requests will result in error 429 (too many requests) until your quota is cleared.
Endpoint - Get list of response headers
This endpoint retrieves list of response headers including redirect chain of a Http connection in JSON format
HTTP Request: GET /v1/headers?domain=domain.tld
examples :
/v1/headers?domain=https://github.com
/v1/headers?domain=www.github.com
response : 
[
  {
    "HTTP": "301 Moved Permanently",
    "Final-URL": "http://github.com/",
    "location": "https://github.com/"
  },
  {
    "HTTP": "200 OK",
    "Final-URL": "https://github.com/",
    "content-type": "text/html; charset=utf-8",
    "strict-transport-security": "max-age=31536000; includeSubdomains"
  }
]

Related tools


Documentation & API reference

How to use the HTTP Headers Checker

Inspect every HTTP response header a URL returns and follow the whole redirect chain hop by hop.

Endpoints

EndpointReturnsExample
/v1/headersJSONdomain=example.com

Parameters

NameTypeDefaultDescription
domainstringrequiredDomain or full URL. Defaults to https:// when no scheme is given.

Code examples

curl 'https://freetools.one/v1/headers?domain=example.com'
const hops = await (await fetch('https://freetools.one/v1/headers?domain=http://github.com')).json();
hops.forEach((h, i) => console.log(i, h.HTTP, h['Final-URL']));
import requests

hops = requests.get('https://freetools.one/v1/headers',
                  params={'domain': 'http://github.com'}).json()
for i, h in enumerate(hops):
    print(i, h['HTTP'], h['Final-URL'])

Example response

[
  {
    "HTTP": "301 Moved Permanently",
    "Location": "https://github.com/",
    "Final-URL": "http://github.com/",
    "server": "GitHub.com"
  }
]

Frequently asked questions

How do I see the response headers of a website?

Call /v1/headers?domain=example.com. The response contains every response header as a key/value pair, plus a Final-URL field showing where the request ended up.

Does it show the full redirect chain?

Yes. Each redirect is followed and reported as a separate entry, up to five hops, so you can spot redirect loops and slow chains.

Can I inspect a URL that redirects to another domain?

Yes. Every hop in the chain is returned, including the final destination, and each host is re-checked against the SSRF guard.

What security headers should I look for?

Check for Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and Permissions-Policy in the returned header map.