HTTP Header Checker
See the HTTP response headers a website returns: status, server software, X-Powered-By, HTTP version and more.
DNS Lookup
WHOIS Lookup
SSL Certificate Checker
Reverse IP Lookup
Nameserver Checker
CDN Checker
WordPress Detector
CMS Version & Extension Checker
Technology Stack Checker
How to read the result
- Status
- The HTTP response code for the homepage. 200 is a normal page; a 301 or 302 means the address redirects somewhere; 403 means something refused the request; 5xx means the server itself is failing.
- Server
- The software the responding machine admits to. Apache, nginx, LiteSpeed and Caddy are the common answers — but a CDN in front replaces this with its own name, so it frequently describes the edge rather than the origin.
- X-Powered-By
- Usually the language runtime, most often a PHP version. Its absence is good practice rather than a gap: there is no reason to tell strangers which runtime version to look up exploits for.
- HTTP version
- HTTP/2 and HTTP/3 multiplex many requests over one connection and are meaningfully faster than HTTP/1.1 on pages with lots of assets.
- Redirects
- A 301 or 302 means the address you entered is not the one that serves the page. Following the chain matters: more than one hop in a row usually means two separate redirect rules fighting each other, which costs every visitor a round trip.
Where this tool is wrong
Every check here reads one signal, and each has a blind spot worth knowing before you act on the answer.
- Anything in front of the origin can rewrite these headers. When a CDN is in the path you are usually reading the CDN's response, and the origin's own headers may look nothing like it.
- Server and X-Powered-By are self-reported strings. A server can be configured to say anything or nothing at all, and plenty are.
- We fetch the homepage only. A different path can be served by entirely different software on the same domain.
Common questions
Why does the server header say cloudflare instead of nginx?
Because Cloudflare answered the request and identified itself. The origin behind it may well be nginx; from outside there is no way to see past the edge, which is intentional.
Should I hide my server version?
It is worth doing and it is not a security measure on its own. Hiding the version slows down opportunistic scanning for known exploits; it does nothing about the vulnerability itself, which is why keeping the software updated matters far more.
What does an empty X-Powered-By mean?
Usually that someone turned it off deliberately, which is the sensible default. It does not indicate a problem.