HTTP status code checker

What this reads

It makes one request to the hostname and reports the status code it settled on, whether a plain HTTP request is redirected to HTTPS, and which security headers came back.

Redirects are followed, so the code shown is where the chain ended rather than the first hop.

The codes worth recognising

• 200 — fine.
• 301 / 308 — moved permanently. Correct for http → https and for www → bare. A chain of three of them is slow and loses a little of whatever search authority the original URL had.
• 302 / 307 — moved temporarily. Frequently used where a 301 was meant, which tells search engines to keep the old URL indexed indefinitely.
• 403 — the server is refusing you specifically. On a check this usually means a WAF or a bot rule is blocking the checker, not that the site is down. Those are different things and only one of them is your problem.
• 404 — nothing there. Worth checking on the bare domain, which is a surprisingly common casualty of a framework upgrade.
• 500 / 502 / 503 — the application or whatever sits in front of it is broken.

A status check is the commodity half of monitoring. It is worth having and it is not what takes sites down — a certificate expiring, a domain lapsing or a mail record breaking will all sail past a 200 without complaint.

Redirecting to HTTPS

If a plain http:// request is not redirected, anything sent before the redirect travels in clear text and can be intercepted or rewritten. The fix is a permanent redirect at the edge, then Strict-Transport-Security so the browser stops trying http altogether.

The security headers

• Strict-Transport-Security — the browser refuses plain HTTP for this domain for the given period. The one header worth having above all others.
• Content-Security-Policy — restricts where scripts may load from, and the main defence against an injected script.
• X-Content-Type-Options: nosniff — stops a browser guessing a file is something more executable than it claims.
• X-Frame-Options / frame-ancestors — stops another site framing yours, which is what makes clickjacking possible.
• Referrer-Policy — controls how much of your URL is handed to sites your visitors click through to.

Missing headers are hardening gaps rather than outages. Worth fixing, not worth being woken up for.

What this checker reads

One HTTP request to the hostname. No account is needed and the domain you type is not stored.