HTTP Header Checker

Can't see what your server sends along with the page?

Response headers are invisible in the browser window, yet they can override your HTML. An X-Robots-Tag set at server level can keep a URL out of the index even when its meta tags look fine, and a missing caching rule can make repeat visitors download everything again. This page turns a raw header dump into a short graded table, so you can spot those settings quickly. Grading happens locally on the text you paste.

Step by step

1. Get the raw headers. From a terminal, curl -I https://yoursite.com/page/ prints them. For a GET request instead of HEAD, curl -s -D - -o /dev/null with the URL does the same.
2. Copy the complete output, starting at the HTTP/1.1 or HTTP/2 status line, into the headers box.
3. Press "Analyze Headers". The status appears first, then a row for each of the eight headers the tool grades, then a list of the remaining headers it found.
4. Scan for crosses first, then warnings. The summary line totals both.

What to watch for

The live button at the top is limited by design. Browsers stop a page's scripts from reading headers sent by other sites, so the tool can only ask a public proxy to load the page and report that it came back. The status it shows belongs to the proxy, the final URL after redirects cannot be known, and your URL is passed to that third party. Use the paste box for anything real. When you paste, keep to a single response: output from curl -IL with several hops is merged, and a header that appears twice keeps only its last value. Header names are matched without regard to case. Compression is often missing from curl -I output even when the server supports it, so repeat the command with --compressed before treating that warning as real.

Questions people ask

Why is X-Robots-Tag the only header that can fail?

Because noindex (or none, which includes noindex) in that header tells search engines not to index the URL, no matter what the page's HTML says. The other checks affect speed, security or caching, so they are warnings.

Is Vary: User-Agent a problem?

Not always, but it tells caches to store a separate copy for each user agent string, which can split cached copies into many versions. The tool flags it so you can confirm it is intentional.

Does a missing HSTS header hurt rankings?

The tool treats it as a security warning, not a ranking issue. HSTS tells browsers to use HTTPS for your domain on later visits, for as long as its max-age allows.

Further reading: The Vary Header and Caching for SEO: Avoiding Cloaking and Stale Pages and Strict-Transport-Security (HSTS) Header Missing: How to Fix It.

The same tool is also published on the static mirror at seoprocheck.github.io, and the rest of the set is on the free tools page.