HTTP header & redirect checker.

Check response headers, follow the redirect chain hop by hop, see where the time goes on each request, and get a security headers review in plain English. Fetched from this server, so you see what a client really goes through.

GET https://kirkdiamond.com/tools/status/302 · 1 hop · 308 ms total JSON · text

Final status 302 Found https://kirkdiamond.com/tools/status/302

Redirects 0 Straight to the final response

Protocol HTTP/2 HTTP/3 advertised via Alt-Svc · TLS 1.3

Security headers Grade A 9 checks, explained below

Redirect chain each hop is a fresh connection

0 302 https://kirkdiamond.com/tools/status/302 308 ms

dns
28.5 ms
connect
10.9 ms
tls
31.3 ms
ttfb
236.8 ms
download
0.0 ms

Server
172.67.128.220:443 · HTTP/2.0

TLS
TLS 1.3 · TLS_AES_128_GCM_SHA256

Type
text/plain; charset=utf-8

Body
10 bytes · uncompressed

Security headers on the final response

pass

Strict-Transport-Security max-age=63072000; includeSubDomains

Browsers that have seen this will refuse to load the site over plain HTTP.
pass

Content-Security-Policy default-src 'self'; style-src 'self'; font-src 'self'; img-src 'self' data:; script-src 'self'; connect-src 'self'; frame-src 'none'; base-uri 'self'; form-acti...

Policy is enforced and script sources are restricted.
pass

Framing frame-ancestors 'none'

CSP frame-ancestors controls which sites may embed this page. It supersedes X-Frame-Options.
pass

X-Content-Type-Options nosniff

Browsers will trust the declared Content-Type rather than guessing, which blocks a class of script-injection tricks.
pass

Referrer-Policy strict-origin-when-cross-origin

Limits how much of the URL other sites learn when a user follows a link.
pass

Permissions-Policy camera=(), microphone=(), geolocation=()

Declares which browser features (camera, microphone, geolocation, payment) the page and its frames may use.
info

Cross-Origin-Opener-Policy missing

Not essential for most sites. same-origin is worth adding if the page handles logins or sensitive data.

Why this matters: HTTP security headers: what each one does and a sensible default set
pass

Server disclosure Server: cloudflare

A product name without a version is fine.
info

Cookies none set

No Set-Cookie headers in the chain, so nothing to audit.

Why this matters: HTTP security headers: what each one does and a sensible default set

Final response headers 17 headers

Alt-Svc	h3=":443"; ma=86400
Cache-Control	no-store
Cf-Cache-Status	DYNAMIC
Cf-Ray	a52372f8fc58b884-LHR
Content-Length	10
Content-Security-Policy	default-src 'self'; style-src 'self'; font-src 'self'; img-src 'self' data:; script-src 'self'; connect-src 'self'; frame-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
Content-Type	text/plain; charset=utf-8
Date	Thu, 29 Oct 2026 16:10:13 GMT
Nel	{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Permissions-Policy	camera=(), microphone=(), geolocation=()
Referrer-Policy	strict-origin-when-cross-origin
Report-To	{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=0cacXKftjG8rhzWT6wQUo55Du33WNRLOfBpvbYBg9QXXqRd1oTNv5QkwlncSdPOr9flU07lNdOGXgyP%2BFYzQ6gPntRJRRSe7TaC0CJtTYVoZ0S1LM4oDUuPCGd34A6EiNtA%3D"}]}
Server	cloudflare
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Robots-Tag	noindex, follow

About this tool

This server fetches the URL you give it with redirects switched off, so each hop in a chain is its own request on its own connection. For every hop it records how long DNS resolution, the TCP connect, the TLS handshake, the wait for the first byte and the body download took, then follows the Location header and does it again, up to ten times. The body is read (up to 2 MB) so the download phase is real, but it is discarded and nothing is stored. The request is sent with a browser-like Accept and Accept-Encoding so the server behaves as it would for a real visitor.

HTTP header checker

The final response headers table shows Content-Type, Cache-Control, Server, Set-Cookie, Vary and everything else the origin or CDN added, exactly as sent, with nothing normalised. Compare it with what your application thinks it is sending: the gap is usually a proxy or CDN rewriting Cache-Control, stripping a custom header, or adding its own Server line. For what the browser sends in the other direction, use the request header checker.

Redirect checker

The redirect chain lists every hop with its status code (301, 302, 307 or 308), its Location header and how long it took. Three hops to reach a page is three round trips your visitors pay for before the first byte of content, and each one is a place for a mixed-content or cookie bug to hide. The chain you want for a canonical site is one hop: http:// anything straight to the final https:// URL. Which code to use for each case is in 301 vs 302 vs 307 vs 308.

Security headers checker

The graded scorecard looks at the final response for Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy, plus version leakage in Server and X-Powered-By and the Secure, HttpOnly and SameSite flags on every cookie set along the chain. Each line says what was found and why it matters rather than just red or green. The two most often missing on otherwise well-run sites are CSP and HSTS; a CSP in report-only mode is a safe first step. The header-by-header explanation and a starting configuration are in HTTP security headers explained, and the domain health checker folds this grade into a whole-domain report.

Response time and TTFB test

The timing bar on each hop splits the request into DNS, connect, TLS, first byte and download. A long first-byte segment is the server thinking (slow application code, a cold cache, a database call); a long TLS segment is a distant edge or a server without session resumption; a long download on a small page is an uncompressed body. Because the fetch comes from this server, the numbers are one vantage point, not your users' experience, but the proportions between the phases are what tell you where to look.

Common findings

HTTP to HTTPS is a 302: should be a 301 or 308 so clients and search engines treat it as permanent. Also check HSTS is set on the HTTPS response; the HSTS preload checklist covers rolling it out safely.
Redirect loop or long chain: http → https → www → trailing slash is four requests. Collapse them into one.
Not compressed: the Body row says "uncompressed" for a text response. Enable gzip or brotli at the CDN or origin.
HTTP/1.1 only: no ALPN h2. Usually an old load balancer or a proxy in front of a modern origin.
Missing security headers: no CSP and no HSTS is common on otherwise well-run sites. Each check explains what to add.
Cookies without Secure or HttpOnly: session cookies sent over HTTP or readable by scripts. The cookies table lists the flags on every one set along the chain.
Server or X-Powered-By leaks a version: nginx/1.18.0 or PHP/7.4 tells attackers exactly what to look up.

Examples

http://example.com: a plain HTTP fetch
http://github.com: an HTTP to HTTPS redirect and a strong header set
a 302 from the status tester: see how a redirect without a Location is reported

From the command line

curl "kirkdiamond.com/tools/http?url=example.com" or add &format=json for the full structured report, and &method=HEAD to skip the body. Only public hosts can be fetched.

Every parameter, the JSON field names, rate limits and ready-made CI checks are in the API and curl reference.