How the checker follows redirects
A browser follows redirects silently and a web page can’t read another site’s headers, so the request is made by our edge function, /api/headers. It sends a plain HTTP/1.1 request, reads the status line and headers, and if the answer is a redirect it works out the next URL and repeats — up to 10 hops, the same limit Googlebot uses. Because the request goes over a raw connection rather than a browser API, the headers are shown exactly as the server sent them, in order, including duplicates and the real Server value.
Every hop is checked before it is requested: only http and https, only ports 80, 443, 8080 and 8443, no embedded usernames or passwords, and the hostname must resolve (via Cloudflare DNS-over-HTTPS) to public addresses only. A redirect pointing at a private or internal address is reported and not followed. For sites hosted on Cloudflare our function has to use Cloudflare’s own fetch, so those hops may merge duplicate headers; the page says when that happens. Nothing you check is stored.
301, 302, 307 and 308: which redirect to use
| Code | Meaning | Method kept? | Use it for |
|---|---|---|---|
| 301 | Moved permanently | May become GET | Permanent URL changes, HTTP→HTTPS, domain moves |
| 308 | Permanent redirect | Yes | Permanent moves of APIs or forms that must keep POST |
| 302 | Found (temporary) | May become GET | Short-term moves, A/B tests, login bounces |
| 307 | Temporary redirect | Yes | Temporary moves that must keep the method |
| 303 | See other | Always GET | After a form submission |
For SEO, Google treats 301 and 308 as strong signals that the new URL should be indexed, and 302/307 as weak ones. Keep chains short: each hop costs a network round trip and wastes crawl budget, so link straight to the final URL and make the first redirect go directly there. The www / https comparison requests all four versions of your address — http and https, with and without www — and checks that they end on one URL. If they don’t, search engines can treat them as separate sites. Before tidying redirects, the SSL certificate checker confirms the HTTPS version works for every name.
How the security grade works
The grade looks at six response headers on the final page, the same set securityheaders.com popularised: Strict-Transport-Security, Content-Security-Policy, frame protection (X-Frame-Options or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy and Permissions-Policy. All six earn an A, and A+ if there are no warnings; five is a B, four a C, three a D, two an E, fewer an F. A page served over plain HTTP can score at most a D, because HSTS cannot apply.
Warnings cover the mistakes that quietly undo a header: CSP allowing 'unsafe-inline' scripts without nonces or hashes, HSTS shorter than six months, the same header sent twice, cookies missing Secure, HttpOnly or SameSite, the obsolete X-XSS-Protection filter, and Server or X-Powered-By values that reveal software versions. Cross-origin isolation headers (COOP, COEP, CORP) are shown but not graded — they matter mainly for sites using powerful features such as SharedArrayBuffer.
A good starting set for most sites: Strict-Transport-Security: max-age=31536000; includeSubDomains, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, X-Frame-Options: SAMEORIGIN, Permissions-Policy: camera=(), microphone=(), geolocation=(), and a CSP deployed in Report-Only mode first.
Caching headers and user agents
The caching panel turns Cache-Control, Expires, ETag, Age, Vary and CDN status headers into plain statements such as “browsers may reuse this for 1 hour; CDNs for 1 day”. HTML pages usually want no-cache or a short max-age so updates appear promptly; fingerprinted assets like app.3f9a1c.js can use max-age=31536000, immutable. A cf-cache-status of DYNAMIC means Cloudflare is not caching the page at all.
Servers sometimes answer differently depending on who is asking, so choose a user agent: our honest checker identifies itself, while the Chrome, iPhone and Android options show what visitors get — handy for spotting mobile-only redirects — and the Googlebot and Bingbot options show crawler handling. Sites can verify genuine crawlers by reverse DNS, so a spoofed Googlebot request may be treated as an ordinary visitor or blocked. A 403 for our checker but not for “Chrome on Windows” means bot protection. To see what your own browser sends, use the user agent parser.
Frequently asked questions
How do I check if a redirect is a 301 or a 302?
Enter the old address and press Check headers. Each hop in the redirect chain shows its status code — 301, 302, 307 or 308 — with the Location it points to and a plain explanation. If a permanent move shows 302 or 307, change the rule on your server or CDN to 301 or 308 so search engines index the new URL.
Why do I get different results from my browser?
Your browser may be replaying a cached 301, applying HSTS (which turns http into https internally with a 307), sending cookies that change the response, or receiving a different page because of its user agent or location. This checker sends a fresh request with no cookies or cache from a Cloudflare data centre, so it shows what a first-time visitor or crawler sees.
What does a redirect loop mean and how do I fix it?
A loop means the chain leads back to a URL it has already visited, so browsers stop with a “too many redirects” error. Typical causes are conflicting rules: a CMS forcing www while the server strips it, or HTTPS being forced at both Cloudflare (Flexible SSL) and the origin. Remove one of the competing rules and check again.
Is the security grade the same as securityheaders.com?
It checks the same six headers and uses a similar A+ to F scale, but the scoring is our own and fully described on this page: all six present for an A, one grade lower for each missing header, and A+ only with no warnings. It also flags duplicate headers, weak CSP, short HSTS and insecure cookies.
Can I check pages on my local network or intranet?
No. To stop the checker being used to probe private networks, it refuses private, loopback, link-local and carrier-grade NAT addresses, internal hostnames, embedded credentials and ports other than 80, 443, 8080 and 8443 — at every hop, including redirects. Use curl -I on your own machine for internal sites.
Does the tool store the URLs I check?
No. The request is made by our edge function and nothing is kept after the answer is returned. The address appears in your browser’s address bar so you can bookmark or share the check, and your chosen user agent is remembered in your own browser only. To resolve hostnames the function asks Cloudflare’s DNS-over-HTTPS service.