HTTP headers checker
See the exact HTTP response headers a website sends, follow its redirects, and check which security headers it uses.
What HTTP headers are
With every page, a web server sends headers: short lines of information about the response, such as its status, content type, caching rules, cookies and the server software. Security headers tell the browser to always use HTTPS (Strict-Transport-Security), which scripts may run (Content-Security-Policy), and whether other sites may frame the page (X-Frame-Options). Developers use this check to debug caching and redirects and to review a site's security settings.
How to use it
- Enter a website address or full URL.
- Press Check headers.
- Read the headers of the final response and see which security headers are missing.
Frequently asked questions
Which security headers should every site have?
At least Strict-Transport-Security, X-Content-Type-Options: nosniff, a frame policy (X-Frame-Options or a CSP frame-ancestors rule) and a Referrer-Policy. A Content-Security-Policy gives the strongest protection but needs careful setup.
Why are the headers different from what my browser shows?
Servers can answer differently depending on the browser, language, cookies or location. This tool requests the page as a normal browser without cookies, from our server.
Does this tool follow redirects?
Yes. It follows up to 10 redirects and shows the headers of the final page, together with the final address.