HTTP Header Checker

HTTP response headers are metadata sent by a server with each response. They describe the content type, caching behavior, security policies, and other instructions for browsers and clients. Headers can affect how pages are rendered, cached, or embedded. Understanding them helps diagnose performance, security, and compatibility issues. This tool shows the headers exactly as returned by the server for the requested URL.

Common security headers include Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. Each addresses a different class of risk, such as downgrade attacks, script injection, or clickjacking. Missing headers do not always mean a site is insecure, but they are useful signals for hardening. Some headers require careful tuning to avoid breaking functionality. Use this tool to verify what is actually served in production.

Many sites redirect from HTTP to HTTPS, and the final HTTPS response may be served by different infrastructure or configuration. As a result, header sets can differ between the initial and final response. Some security headers only make sense on HTTPS and may be absent on HTTP. To get the most accurate view, test the exact URL users access after redirects.

A header is marked missing when it is not present in the response. This can happen because the server or framework does not set it, a proxy strips it, or a CDN overrides it. Some headers are optional and not required for every site. If a header is expected, confirm your server configuration and check whether intermediate services are modifying responses.

No. This tool focuses on response headers returned by the server. Request headers are generated by the client and vary by browser, device, and network. If you need to inspect request headers, use browser developer tools or a proxy. The response headers are usually the most important for security and caching configuration checks. Request headers are still valuable when debugging authentication or CORS issues.

Cache-Control directives define how browsers and intermediaries store responses. Values like max-age set a freshness lifetime, while no-store prevents caching entirely. For static assets, longer caching can improve performance, while dynamic content may require short or no caching. CDNs can add or override caching behavior, so confirm directives at the edge. Use these directives carefully to balance speed and freshness, and confirm they align with your deployment strategy.