Six angles on "what is this URL actually doing"
These tools all inspect the same layer — the HTTP response and the crawl rules around it — but from different angles: raw headers, security-specific headers, one particular header you're building, the status code itself, the redirect chain leading to it, and the crawler rules controlling access to it.
HTTP Headers — the raw response
HTTP Headers fetches a URL and displays the complete raw response headers — server software, caching directives, content type, cookies, and any custom headers the server sends.
When to use it: checking what server software or CDN fronts a site, debugging caching behavior via Cache-Control and ETag, or verifying custom headers were actually applied after a deploy.
Reading results: Server and X-Powered-By headers, when present, can reveal the tech stack — useful for debugging, but many sites intentionally strip these for security, so their absence isn't unusual on its own. Cache-Control's max-age tells you how long a response stays fresh to browsers and CDNs.
Security Headers — the security-relevant subset
Security Headers checks for the presence and configuration of security-relevant headers specifically — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, and others.
When to use it: auditing a site's baseline security posture, verifying headers were actually deployed correctly after a config change, or comparing your setup against a competitor's or a best-practice baseline.
Reading results: missing headers aren't automatically critical — context matters. HSTS missing on an HTTP-only-by-design site isn't the same severity as HSTS missing on a login page. Prioritize CSP and HSTS first; they have the broadest impact on XSS and downgrade-attack protection respectively.
CSP Builder — constructing one header correctly
CSP Builder helps construct a Content-Security-Policy header by selecting allowed sources for scripts, styles, images, fonts and other resource types, then generates the correct syntax.
When to use it: adding CSP for the first time without hand-writing directive syntax, tightening a policy that was originally too permissive, or testing a policy change before deploying it.
Reading results: start with Content-Security-Policy-Report-Only in production before enforcing — it logs violations without blocking anything, so you catch resources you forgot to allowlist before they break for real users.
HTTP Status — what code a URL returns
HTTP Status requests a URL and reports the status code — 200, 301, 404, 500 and everything between — along with the final URL after any redirects.
When to use it: confirming a page is actually live and returning 200, checking what a broken or old link now returns, or monitoring whether an API endpoint responds correctly.
Reading results: 2xx means success, 3xx means redirected, 4xx means a client-side problem, 5xx means the server itself errored. A 200 on a page that visually looks broken usually means the server is fine but application logic or content is wrong — a different debugging path entirely from a 5xx.
Redirect Tracer — the full chain
Redirect Tracer follows every redirect (301, 302, 307, meta-refresh) from a starting URL through to the final destination, showing each hop and its status code.
When to use it: debugging an SEO issue caused by chains that are too long or that loop, verifying a shortened or marketing link lands where intended, or checking that HTTP correctly redirects to HTTPS without HTTPS then redirecting again unnecessarily.
Reading results: 301 and 302 carry different SEO weight — search engines pass link equity through 301s but treat 302s more cautiously. A chain of more than two or three hops is worth shortening; each hop adds latency and a small amount of equity loss.
robots.txt Tester — what crawlers are told
robots.txt Tester fetches a site's robots.txt and validates its directives — User-agent groups, Disallow/Allow rules, and Sitemap references.
When to use it: confirming robots.txt isn't accidentally blocking pages you want indexed, checking what a specific crawler (Googlebot, Bingbot, GPTBot) is allowed to access, or verifying the Sitemap directive points to a working URL.
Reading results: rule order and specificity matter — a more specific Disallow overrides a broader Allow depending on the crawler's interpretation. Remember robots.txt only requests crawlers skip a path; it doesn't prevent indexing if the page is linked from elsewhere — use a noindex meta tag for that instead.
How these fit together
Check HTTP Status and Redirect Tracer first when something looks broken from the outside — they diagnose availability. Move to HTTP Headers and Security Headers when availability is fine but you're auditing configuration. Reach for CSP Builder and robots.txt Tester when you're actively changing something rather than diagnosing — they're construction tools, not just inspection tools.