HTTP Header Checker

Enter a URL to see every response header it sends and get its security headers graded — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — plus caching, compression and version-leak checks. Free, instant, no signup.

What this checks & how to fix it

The tool sends one GET request with a normal browser User-Agent, follows any redirects, and reads the headers on the final response without downloading the body. It then sorts what it found into three groups. Security headers are graded against current browser behaviour: for example Strict-Transport-Security needs a max-age of at least six months to matter, and a Content-Security-Policy whose script-src allows 'unsafe-inline' without a nonce or hash gives almost no protection. Caching and performance looks at Cache-Control, ETag / Last-Modified validators and whether the response was compressed with Brotli or gzip. Information disclosure flags Server, X-Powered-By and similar headers that reveal exact software versions.

How to fix what it finds

Every finding names the header and a value that fixes it. Add missing headers at the layer that sends the response — your framework config, the web server, or the CDN — and introduce a CSP as Content-Security-Policy-Report-Only first so you can see what it would block before it blocks anything. Version-leaking headers are removed with a one-line setting in every major server (nginx server_tokens off, Apache ServerTokens Prod, Express app.disable('x-powered-by')). The full header table at the bottom is the raw response, sorted alphabetically, so you can confirm a change landed after deploying.

Frequently asked questions

Do security headers affect SEO?

Not directly — Google does not rank pages by their Content-Security-Policy. But HSTS keeps every visit on HTTPS, which is a confirmed ranking signal, and a site that gets defaced through a missing CSP or clickjacked through a missing X-Frame-Options can be flagged as unsafe in Search Console and lose rankings overnight. Treat these as insurance for the rankings you already have.

Why is the score based only on the security headers?

The six security headers have unambiguous right answers, so they can be graded fairly: HSTS and CSP carry 25 points each, clickjacking protection and X-Content-Type-Options 15 each, Referrer-Policy and Permissions-Policy 10 each. A header that is present but weak (a short HSTS max-age, a CSP that allows unsafe-inline) earns half. Caching and information-disclosure findings depend on what the page is for, so they are shown as advice rather than scored.

Where do I add these headers?

At whichever layer sends the response. On Vercel and Netlify it is a headers block in vercel.json or netlify.toml; in Next.js you can also return them from next.config.ts. On nginx use add_header inside the server block, on Apache use Header set in the vhost or .htaccess, and behind Cloudflare you can inject them with a Transform Rule. Re-run this tool after deploying — the check reads the live response, not a config file.

Which URL is checked if there is a redirect?

The tool follows redirects and reports the headers of the final page, with the original URL shown underneath. That matches what a browser sees. If you want the headers on the redirect hop itself — for example to confirm HSTS is also sent on the http:// to https:// redirect — run the Redirect Checker for the chain, then paste each hop into this tool.

Is X-XSS-Protection still needed?

No. Every modern browser has removed the XSS auditor it controlled, and Chrome's version was actually abused to leak information before it was dropped. It is not checked here on purpose; a Content-Security-Policy is the header that protects against cross-site scripting today.

Related tools

DNS LookupSSL Certificate CheckerDomain Age CheckerIP & Hosting Lookup

Command Palette

Search for a command to run...