Wivrix

Network & Domain

HTTP Headers Checker

Check HTTP response headers and get an A+ to F security grade: HSTS, CSP, framing, cookies, CORS, info leaks and HTTP-to-HTTPS redirect, with nginx, Apache and Cloudflare fix snippets.

Fetch URL mode queries the site from our server, so the URL you enter is sent to Wivrix. Paste headers mode runs entirely in your browser. Nothing is stored.

Read the step-by-step guide →

⚠ Network lookup — not fully local. In Fetch URL mode the URL is fetched by the Wivrix server, because browsers cannot read another site's response headers. Paste headers mode runs entirely in your browser. We do not store header reports.

API usage for developers (cURL) 
curl -X POST https://wivrix.com/api/headers \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "method": "HEAD", "follow_redirects": true, "user_agent": "desktop", "check_http_redirect": true}'
Developer / raw response

What is this tool?

This HTTP headers checker shows the response headers a website sends and grades its security setup from A+ to F. Enter a URL, pick HEAD or GET and a User-Agent (Wivrix checker, desktop Chrome, iPhone Safari, Googlebot or curl), and press Check Headers. The report validates the values, not just presence: HSTS max-age, CSP unsafe-inline, unsafe-eval and wildcards, X-Frame-Options or CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It flags deprecated headers (X-XSS-Protection, Expect-CT, HPKP, Feature-Policy) and version leaks in Server and X-Powered-By. It also audits every Set-Cookie for Secure, HttpOnly and SameSite, checks CORS, COOP/COEP/CORP and caching, and confirms that the http:// version redirects to HTTPS. You see the redirect chain hop by hop, plus copy-ready fix snippets for nginx, Apache and Cloudflare. Browsers cannot read another site's headers, so URL checks run on a Wivrix server; Paste headers mode analyses curl -I or DevTools output entirely in your browser. TLS certificates are not inspected.

How to Use

  1. Type the address into URL to check, for example https://example.com, or switch to Paste headers and paste curl -I output.
  2. Choose a Method and User-Agent, and keep Follow redirects and the HTTP-to-HTTPS check ticked.
  3. Press Check Headers or Enter (Ctrl+Enter in paste mode).
  4. Read the grade, problems and warnings, the cookie table and the redirect chain.
  5. Open How to fix for nginx, Apache or Cloudflare snippets, and copy the headers, report or a share link.

Frequently Asked Questions

Why is my URL sent to a server?

Browsers block pages from reading another site's response headers, so a Wivrix Cloudflare Worker fetches the URL and returns the headers. Only the URL and your options are sent, and private or internal addresses are blocked. Paste headers mode never leaves your browser.

How is the grade calculated?

Each site starts at 100 points. Missing or weak security headers, unsafe cookie flags, risky CORS, version leaks and a missing HTTP-to-HTTPS redirect cost points. A+ needs 95 or more, no problems and all six core headers passing; then A is 85+, B 70+, C 55+, D 40+ and F below that.

Should I use HEAD or GET?

HEAD is faster because no page body is downloaded, but some servers answer it differently. If a HEAD request returns 404 or 405, the checker retries with GET and says so next to the method.

Does it check my TLS certificate?

No. It reports whether the HTTPS request succeeded, but does not inspect the certificate's issuer, expiry or chain.

How many redirects does it follow?

Up to five hops, each shown with its status code, method and Location. The security headers are graded on the final response.

Related tools

People who use this tool often need these too.

DNS Lookup

A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records.

 Network & DomainNeeds network

WHOIS Lookup

Domain registration, registrar, expiry and nameservers.

 Network & DomainNeeds network

IP Address Info

Reverse DNS, network class and binary or hex representations.

 Network & DomainNeeds network

User Agent Parser

Identify browser, engine, operating system and device.

 Network & Domain

Other tools

There are more calculators, converters and editors on Wivrix. If something is missing, tell us.

Browse all tools Suggest a tool