Free HTTP Header Checker

An HTTP header checker shows the response headers a server sends with a page, before any content loads. The free HTTP Header Checker above lets you enter a URL and view those headers, including cache, security and X-Robots-Tag directives, so you can spot hidden indexing or caching problems.

Google documents that the X-Robots-Tag can be used as an element of the HTTP header response for a given URL, which means a page can be set to noindex without a single visible change in its HTML.

How to use the HTTP Header Checker

Enter the full URL of the page, file or image you want to inspect.
Run the check and wait for the server to respond.
Scan the list of headers, starting with the status line and then the cache, security and robots directives.
Compare against what you intended. Check the same URL again after any change to your server, CDN or plugins.

How to read the results

Headers are name and value pairs. You do not need to know them all, only the groups that matter for search and security.

X-Robots-Tag carries indexing instructions such as noindex or nofollow. If you see noindex on a page you want ranked, that is a serious problem even though the page looks fine.
Cache headers such as Cache-Control, Expires and ETag tell browsers and CDNs how long they may reuse a response. Very short or missing caching can make repeat visits slower.
Security headers such as Strict-Transport-Security and Content-Security-Policy show which protections the server asks the browser to apply.
Content-Type tells the browser what kind of file this is. A wrong type on a PDF or an XML sitemap can cause odd behaviour.
Location appears on redirect responses and shows where the server is sending the visitor.

A healthy result for a normal page has no accidental noindex directive, a sensible cache policy, and the security headers you decided to use.

Common problems this finds

A noindex sent by header. Staging settings sometimes get copied to the live server. Remove the X-Robots-Tag rule in the server or plugin that adds it, then re-test.
Conflicting signals. The header says one thing and the HTML meta robots tag says another. Decide what you want and make them agree.
Missing or very short caching. Add a cache policy for static files such as images, scripts and stylesheets, and test again.
No HTTPS enforcement header. If the site is fully on HTTPS, consider asking the browser to remember that with the right security header, after you have confirmed every page and subdomain works securely.
Wrong content type. Correct the server configuration so files are labelled as what they are.

Why headers matter for SEO

Googlebot reads headers before it reads your page. A noindex in the header can remove a page from results, and cache and security settings affect speed and trust. One point is easy to miss: Google states that if a page is disallowed from crawling through robots.txt, any indexing or serving rules about it will not be found and will therefore be ignored. So an X-Robots-Tag only works when the URL can actually be crawled. You can test crawl permission with the Robots.txt Tester and AI Crawler Checker.

A worked example

This is an illustrative example. Imagine a blog post that stopped appearing in search after a server migration. The page looks normal and the HTML has no robots tag. You enter the URL in the checker and the header list includes X-Robots-Tag: noindex. The new server had a rule copied from a staging site that adds the header to every response. You remove the rule, test the URL again to confirm the header is gone, and then ask Google to recrawl the page. Without a header check, you could have searched the page source for days and found nothing.

The same habit helps after any change to hosting, a CDN or a security plugin, because those layers can add or alter headers without touching your content. A quick check of your home page, a typical post, and one image or PDF takes a minute and catches most surprises.

What the checker cannot tell you

The tool asks this site’s server to request the public URL you enter, so you see the headers returned to that request. A site may send different headers to browsers, to logged-in users, or to bots it has decided to block, and some sites block automated requests altogether. Headers added by JavaScript do not exist, because headers come from the server. There is a fair-use limit on repeated checks. If the URL redirects, use the Redirect and Status Code Checker to follow each hop.

Questions about the HTTP Header Checker

Can a page be noindexed without anything in its HTML?

Yes. A noindex can be sent as an X-Robots-Tag in the HTTP header, so the page source shows nothing. That is why a header check is worth running when a page will not index and the HTML looks clean.

Which headers should I look at first?

Start with the status line and X-Robots-Tag, because they decide whether the page can be indexed. Then look at Cache-Control for speed and the security headers for browser protections.

Does a security header improve my rankings?

Do not expect a direct ranking effect from adding one. Security headers protect visitors and help the site behave safely. Treat them as good hygiene rather than a ranking tactic.

Back to all free technical SEO tools or the full toolkit. If you would rather have someone check the whole site, see my technical SEO services or ask for a free audit.