HTTP Headers

HTTP is a request-response protocol whose meaning is defined once in RFC 9110 (HTTP Semantics) and then carried over three wire formats: HTTP/1.1 (RFC 9112), HTTP/2 (RFC 9113) and HTTP/3 over QUIC (RFC 9114). Whatever the version, every response starts with a three-digit status code and a set of header fields. The first digit gives the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error. Reading the exact code is the fastest way to tell whether a problem lies with the request, the application or the infrastructure in front of it.

Redirects deserve special attention. 301 Moved Permanently and 308 Permanent Redirect tell clients and search engines to replace the old URL; 302 Found and 307 Temporary Redirect say the original URL remains canonical. 307 and 308 additionally guarantee that the method and body are preserved, so a POST stays a POST. The target is given in the Location header, which may be relative. Each extra hop in a chain such as http://example.com -> https://example.com -> https://www.example.com -> /en/ costs a full round trip, may need a new TLS handshake and dilutes crawl budget, so the goal is a single 301 or 308 from any variant straight to the final URL. Loops, where two rules keep bouncing a request back and forth, typically appear when a CDN talks plain HTTP to an origin that insists on HTTPS.

Error classes point to different layers. 404 Not Found and 410 Gone come from the application, and a page that displays 'not found' while returning 200 is a soft 404 that search engines treat as low-quality content. 401 and 403 relate to authentication and authorization, though a 403 delivered only to automated clients usually comes from a WAF rule. 502 Bad Gateway and 504 Gateway Timeout are produced by a proxy or load balancer that could not get a valid or timely answer from the upstream server, while 503 Service Unavailable often signals maintenance or overload, ideally with a Retry-After header.

Caching headers, defined in RFC 9111, decide how long browsers and CDNs may reuse a response. 'Cache-Control: public, max-age=31536000, immutable' suits fingerprinted static files, whereas personalised HTML should use 'private' or 'no-store'. The Server header reveals software and sometimes versions, which is useful for debugging but needlessly informative to attackers.

This tool makes one request to the URL you enter, adding https:// if no scheme is given, and deliberately does not follow redirects, so you see exactly what the first server answers. It reports the status code and text, the time until the response arrived, the Server, Content-Type and Cache-Control headers, four key security headers and, for 3xx responses, the Location target. 2xx is a pass, 3xx a warning that shows where the chain continues, and 4xx or 5xx a failure. On HTTPS, missing HSTS, X-Frame-Options or X-Content-Type-Options also produce warnings. Private and reserved targets are refused to prevent request forgery.