DotComPals - Come, grow with the web

Security Headers and Redirect Checker

See the redirect path from http and https, and whether your site sends the six security headers browsers expect.

Enter a domain only, no http:// needed.

How this works

  1. We follow redirects hop by hop from both http:// and https:// and show each status code.
  2. We read response headers from the final page: HSTS, Content-Security-Policy, clickjacking protection, nosniff, Referrer-Policy and Permissions-Policy.
  3. We flag missing HTTPS redirects, long chains, loops, temporary redirects and server version leaks.

Frequently asked questions

Is a missing CSP serious?

It is the hardest header to set correctly and a wrong CSP can break your site. Treat it as a planned project, not a quick toggle.

Why does the redirect chain matter for SEO?

Each extra hop slows the page and wastes crawl budget. Aim for a single 301 to the final address.

What is HSTS?

It tells browsers to use only HTTPS for your domain. Add it once HTTPS works everywhere.

Is this a full security audit?

No. It checks headers and redirects only.

More free tools

Website Tech and Tracking Detector | PageSpeed and Core Web Vitals Checker | WordPress Site Checker | Website Project Brief Builder | All free tools