FREE TOOL
HTTP headers checker
Every response header the page sends, plus a quick score for six key security headers.
All response headers
| Header | Value |
|---|
This tool sends a request to our checking server. Addresses and files are processed on the spot and never stored.
WHAT IT DOES
About this tool
Look up the HTTP response headers of any URL and see how its security headers stack up: HSTS, CSP, X-Frame-Options, X-Content-Type-Options and more.
The check runs on our server: we send only the address or file you entered and show the result right away. Nothing is stored.
QUESTIONS
Frequently asked questions
Which security headers matter most?
Strict-Transport-Security (forces HTTPS), Content-Security-Policy (stops injected scripts), X-Content-Type-Options: nosniff, and framing protection through X-Frame-Options or frame-ancestors. Referrer-Policy and Permissions-Policy are smaller wins that take a minute to add.
Can headers break my site?
Most can't. Content-Security-Policy can, because it blocks scripts and styles from any source you haven't listed. Start with Content-Security-Policy-Report-Only to see what would be blocked, then switch it on for real.
Where do I add these headers?
In your server config (nginx add_header, Apache Header set in .htaccess), in your CDN settings such as Cloudflare Transform Rules, or with a security plugin on WordPress.
06 / LET'S GET ACQUAINTED
TELL US
WHAT YOUR
BUSINESS NEEDS
Describe the task. Together we'll
work out the next step.