{{ summaryTitle }} {{ summaryValue }} {{ summaryLine }} {{ badge.label }}{{ badge.value }}
Bare hostnames start at HTTP so an HTTP-to-HTTPS redirect remains visible. The sample is not requested on page load.

{{ runStatus }}

The hop ledger records the actual method used, including any allowed HEAD-to-GET retry.
Tool default is the safest general probe. Pin a familiar browser or crawler only when that route is the question.
Use 1–300 characters without line breaks.
Use 200–4,000 milliseconds.
ms
Use 1–20 redirects. An incomplete trace remains visibly marked.
Disabling validation weakens the probe and is reported in the findings.
{{ params.validate_tls ? 'On' : 'Off' }}
Used only when Request method is HEAD.
{{ params.get_on_405 ? 'On' : 'Off' }}
StatusCheckEvidenceNext stepCopy
{{ severityLabel(row.severity) }}{{ row.check }}{{ row.evidence }}{{ row.next_step }}
HopURLStatusMethodLocationTime (ms)Copy
{{ row.hop }}{{ row.url }}{{ row.status }}{{ row.method }}{{ row.location }}{{ row.elapsed_ms }}
{{ replayText }}
Hypertext Transfer Protocol (HTTP) Header Checker Check a public URL’s HTTP headers across redirects and review security, cache behavior, browser state and cross-origin exposure.
Gzip Compression Checker Check a public URL or pasted headers for gzip, Brotli, or identity compression with cache-variation checks and measured byte savings.
SSL Expiry Checker Check a live TLS listener for certificate expiry and SAN coverage, then verify renewal timing plus the served serial number and fingerprints.
Web Server Detector Detect visible server and application clues at a public URL, including CDN or proxy evidence across redirects and a clear confidence score.

A redirect tells an HTTP client to request another URL from the address in the response’s Location field. One intentional hop is common when a site moves from HTTP to HTTPS or from an old hostname to a canonical hostname. Extra hops add latency and create more places for caches, proxies, certificates, and routing rules to disagree.

Status codes also carry intent. A 301 or 308 describes a permanent move, while 302, 303, and 307 are temporary redirects. Method handling differs by status and client, so a route observed with HEAD is not automatically identical to one observed with GET. Crawlers, mobile identities, CDNs, and origin rules can also receive different paths from the same starting URL.

Redirect chain
The ordered responses from the starting URL to the last observed destination.
Host handoff
A hop that changes the hostname, such as moving from an apex domain to www or to another service.
Protocol downgrade
A hop from HTTPS back to HTTP, which breaks the secure route.
HSTS evidence
Presence of a Strict-Transport-Security field on the final HTTPS response, not proof that the whole HSTS policy is correct.

Redirects produced by JavaScript or an HTML meta refresh are not HTTP redirect responses and require a browser-rendering test. One successful trace is also not a performance benchmark: DNS answers, CDN edges, geography, cache state, request method, and client identity can change both the route and its timing.

How to Use This Tool:

Trace one public HTTP or HTTPS target with the method and client identity that match the route you need to verify.

  1. Enter Public URL. A bare hostname starts at HTTP so an HTTP-to-HTTPS upgrade remains visible. Do not submit private, local, authenticated, signed, or sensitive URLs.
  2. Choose Request method and Client identity. HEAD is a lightweight route probe; use GET when the origin treats HEAD differently. A custom User-Agent must be a single line from 1 to 300 characters.
  3. Set Advanced limits when needed. Timeout per hop accepts 200 to 4,000 milliseconds, Maximum redirects accepts 1 to 20, and TLS certificate validation should normally remain on.
  4. Select Trace, then compare the final destination, status, hop sequence, method path, transport changes, and timing. If settings change, run a new trace so the evidence matches them.

Interpreting Results:

Direct secure route means no redirect was observed, the final response was HTTPS with visible HSTS, and no hop exceeded 500 ms. Clean redirect route means the score is at least 80 with no temporary redirect or slow hop. Other complete routes remain Route review unless a stronger state applies.

  • Incomplete trace takes priority when the redirect limit or request deadline stops the route.
  • Destination failed means the final status is outside 200 through 299.
  • Transport downgrade means the final URL is HTTP or at least one observed hop moved from HTTPS to HTTP.
  • The 500 ms line and route health score are local review aids, not HTTP standards or a service-level objective.

Technical Details:

The trace makes one remote request at a time with automatic redirect handling disabled. A 300-level response is followed only when it includes a Location value that can be resolved against the current URL. The ordered evidence records the requested URL, actual method, status, resolved destination, elapsed milliseconds, and selected response headers for each hop.

Mechanism Core:

ConditionBehavior
Bare hostnameNormalize to an HTTP URL before the first request.
HEAD returns 405Retry that hop as GET when the fallback setting is enabled; continue with GET afterward.
301 or 302Follow Location and preserve the current HEAD or GET method.
303Follow Location using GET.
307 or 308Follow Location and preserve the current method.
Missing Location or non-redirect responseStop at the current response.
Redirect count exceeds the selected maximumKeep the observed hops and mark the trace incomplete.
Request failure or per-hop timeoutStop and report that the remote request did not complete.

The final HSTS value is true only when the last observed HTTPS response contains Strict-Transport-Security. Certificate coverage, directive validity, preload eligibility, subdomain coverage, and browser cache state are outside that check. The replay command reproduces the selected primary method and limits, but it does not reproduce the conditional HEAD-to-GET retry.

Formula Core:

The advisory route health score starts at 100 and subtracts transparent penalties. Indicator variables equal 1 when the named condition is present and 0 otherwise.

S=max(0,100 −20I −30F −min(24,8R) −5T −5L −15H −5K −min(12,3X) −20D −15U)
SymbolMeaning
ITrace is incomplete.
FFinal status is not in 200 through 299.
RNumber of redirects, penalized by 8 points each up to 24.
TCount of 302, 303, and 307 temporary redirects.
LCount of hops whose elapsed time is greater than 500 ms.
HFinal URL is not HTTPS.
KFinal URL is HTTPS but the final response has no visible HSTS field.
XHost handoff count, penalized by 3 points each up to 12.
DNumber of HTTPS-to-HTTP downgrades.
UAn observed URL repeats in the chain.

After scoring, state selection follows a separate precedence: incomplete, failed final destination, insecure transport, direct secure route, clean redirect route, then review. A high score cannot override an incomplete, failed, or insecure route.

Privacy Notes:

A live trace sends the target URL, selected User-Agent, method, timeout, redirect limit, and TLS settings to a remote checker after you select Trace. No request is made for the sample on page load, and the target URL and custom User-Agent are not kept in shareable page state.

  • Use only public, non-sensitive URLs. Query strings can contain tokens, identifiers, or personal data and will be visible to every server reached by the route.
  • Disabling TLS validation weakens the probe and should be limited to diagnosing a known certificate problem.
  • The remote observation may differ from a user’s browser because it comes from another network location and does not execute page scripts.

References: