Response codes, the redirect chain, and the headers that matter: HSTS, CSP,
X-Frame-Options, Referrer-Policy and the rest. Both
http:// and https:// are tried, so a site that never
redirects to TLS is visible as such.
Each row is one hop of the redirect chain: the URL, the status it answered with, and
the headers we care about. A site that answers 301 to
https:// and then 200 is doing the right thing; one that
answers 200 to plain http:// is not. We stop after a few
hops, and private or loopback targets are refused.
More tools: all network tools · DNS records · HTTP headers · TLS certificate · API · badge · ad & analytics checker · traceroute globe.