HTTP headers checker
See the HTTP headers your browser sends with every request, and fetch the response headers of any URL to check redirects, caching and security settings — the raw data behind what websites know about you and what they promise to your browser.
Your request headers
5 headers your browser sent with the request for this page, exactly as our server received them. Cookie and authorization values are never shown.
| Header | Value | What it tells a website |
|---|---|---|
| host | checkmyip.com | The site you asked for; lets one server host many sites. |
| user-agent | Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) | Browser, version and operating system. Modern browsers freeze parts of it; the details move to the Sec-CH-UA client hints. |
| accept | */* | Which content types the browser can show, in order of preference. |
| accept-encoding | gzip, br | Compression methods the browser understands (gzip, br, zstd). |
| connection | Keep-Alive | Connection management (keep-alive); not sent over HTTP/2 and HTTP/3. |
6 headers added by our edge network (not sent by your browser)
Cloudflare, which fronts this site, adds these before the request reaches our code. Other sites behind a CDN receive the same kind of headers; your browser never sends them.
- cf-connecting-ip
216.73.216.52— Your public IP address as seen by Cloudflare — this is where the site reads your IP from.- cf-ipcountry
US— The country Cloudflare's edge geolocation assigns to your address.- cf-ray
a4e8027e28d7cac0— Cloudflare's request id; the suffix is the data center that served you.- cf-visitor
{"scheme":"https"}— Whether you connected to the edge over https.- x-forwarded-proto
https— The scheme you used to reach the edge.- x-real-ip
216.73.216.52— Your address, repeated for software that expects this name.
Check any URL's response headers
We fetch the URL from our server (GET only, at most three redirects, five seconds per hop), show each response's status and headers, and grade the final response's security headers.
| Header | Status | Finding |
|---|
| Header | Value |
|---|
Grading follows the six headers securityheaders.com scores: all six over HTTPS with no warnings is A+; each missing header costs one letter. Our fetch identifies itself as CheckMyIP-HeaderCheck.
Your request headers
Every header our server received from your browser, exactly as sent. Most are routine content negotiation; two kinds reveal more than people expect.
User-Agent and Accept-Language
Your browser, version and system, and the languages you accept in order of preference. The language list is one of the stronger fingerprinting signals and a classic VPN giveaway when it does not match the address's country. Decode the user agent on the user agent page.
X-Forwarded-For and Via (proxy giveaways)
Headers added by proxies on the way: Via names the proxy, X-Forwarded-For carries the original client address. A transparent corporate or ISP proxy adds them without asking you; a VPN does not. If you see your real address in X-Forwarded-For while using a proxy, the proxy is leaking it.
Check a URL's response headers
Enter a URL and we fetch it from our server, following redirects, and show each response's status and headers. Requests to private and internal addresses are refused; fetches are rate-limited and never run scripts.
Redirect chain
Each hop from the URL you entered to the final page: HTTP to HTTPS, www to apex, trailing-slash fixes, geo-redirects. Long chains cost time and SEO; a loop or a redirect to an unexpected host is a misconfiguration.
Security headers grade
The final response is graded on the headers that protect visitors.
HSTS, CSP, X-Frame-Options
Strict-Transport-Security forces HTTPS on future visits; Content-Security-Policy limits where scripts and resources may load from (the strongest defense against injected scripts); X-Frame-Options or CSP's frame-ancestors stop the page being embedded in a hostile frame. We also check X-Content-Type-Options, Referrer-Policy and Permissions-Policy. The grade is a checklist, not a security audit; a missing header is a prompt, not a vulnerability.
Frequently asked questions
What is an HTTP header example?
Content-Type: text/html; charset=utf-8 in a response, or Accept-Language: en-GB,en;q=0.9 in a request. A header is a name, a colon and a value, one per line, before the body.
Why do we need HTTP headers?
They carry everything about a request or response that is not the content itself: what format is wanted, whether it can be cached, where to redirect, which cookies apply, how the page may be framed, which languages the client prefers.
How to see the HTTP headers in Chrome?
Open DevTools (F12) › Network, reload, click any request: the Headers tab shows request and response headers. This page shows your request headers without DevTools.
Are headers case sensitive?
Header names are case-insensitive (content-type equals Content-Type; HTTP/2 sends them lowercase). Values may be case-sensitive depending on the header.
Is there a maximum size for HTTP headers?
No fixed limit in the standard; servers set their own, typically 8–16 KB for all headers together. Larger requests get a 431 or 400 error.
How can I check my HTTP headers online?
Your request headers are shown at the top of this page. For a site's response headers, enter its URL in the checker.
How to check HTTP response header in Chrome?
DevTools › Network › click the request › Headers › Response Headers. Or enter the URL on this page to see them from our server's point of view, including the redirect chain.
Request headers are read from this single request and shown once; URL checks are made by our own server, read only headers (never bodies) and store nothing.