Why paste instead of entering a URL?
Web pages are not allowed to read the headers of other websites: browsers block such cross-site requests for security, and many "online header checkers" therefore send your URL to their own server and fetch it from there. Running curl yourself takes a second, shows exactly what your server returns to you, and works for internal and staging hosts that no public tool can reach. Nothing you paste here leaves your browser.
-s hides the progress bar, -I sends a HEAD request (headers only), and -L follows redirects, printing each response in turn. If a server mishandles HEAD requests (some answer 405 or 404), use curl -sL -D - -o /dev/null URL instead, which makes a normal GET and prints only the headers. To see what Googlebot gets, add -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"; some servers answer bots differently.
Reading a redirect chain
A typical chain for someone typing example.com:
HTTP/1.1 301 Moved Permanently
Location: https://example.com/
HTTP/2 301
location: https://www.example.com/
HTTP/2 200
content-type: text/html; charset=UTF-8Two hops before the page: first to HTTPS, then to www. It works, but every hop costs a round trip, and long chains waste crawl effort. Better: redirect http://example.com/ straight to https://www.example.com/ in one step. Googlebot follows up to 10 hops; browsers give up at around 20.
Status codes that matter for SEO
| Code | Meaning | Use it for |
|---|---|---|
| 301, 308 | Moved permanently | Changed URLs, HTTP to HTTPS, domain moves. Search engines index the target. 308 keeps the request method (matters for forms and APIs, not for pages). |
| 302, 307 | Moved temporarily | Short-term moves (a sale page, maintenance). Google keeps the original URL at first; a "temporary" redirect left for months is eventually treated as permanent. |
| 304 | Not modified | Answer to a conditional request: the cached copy is still good. Saves bandwidth on repeat crawls. |
| 404, 410 | Not found, gone | Pages that no longer exist. 410 says it is deliberate; Google drops it a little sooner. Do not redirect every missing page to the home page: Google treats that as a "soft 404" anyway. |
| 429, 503 | Too many requests, unavailable | Overload and maintenance. Googlebot backs off and retries. Add Retry-After. Do not serve 503 for days. |
| 500, 502, 504 | Server errors | Never intended. If they persist, Google crawls less and eventually drops the URLs. |
Caching headers in plain words
Cache-Control: max-age=3600: browsers may reuse the response for an hour without asking.s-maxagesets the time for shared caches such as CDNs.no-cachedoes not mean "do not cache"; it means "check with the server before reusing".no-storeis the one that forbids storing.ETagandLast-Modifiedlet a client ask "has it changed?" and get a cheap 304 if not.Varylists request headers that change the response (for exampleAccept-Encoding); caches keep one copy per value.- Files with a version or hash in their name (
app.3f9a1c.js) can be cached for a year withimmutable; HTML pages usually should not be cached for long.
Security headers
- Strict-Transport-Security (HSTS) makes browsers use HTTPS for your host for
max-ageseconds. Six months to a year is usual; start shorter while testing. - Content-Security-Policy limits where scripts, styles and frames may load from. It is the strongest defence against injected scripts, and its
frame-ancestorsdirective replacesX-Frame-Options. - X-Content-Type-Options: nosniff stops browsers guessing file types.
- Referrer-Policy controls how much of your URL is sent to other sites when visitors follow links.
The checker also flags X-Robots-Tag (a noindex here removes the URL from search even when the HTML looks fine), canonical URLs sent in a Link header, missing charsets, and headers that reveal server software versions.