HTTP Header Checker
Inspect HTTP response headers, security headers, redirect chain, and caching for any URL
Frequently Asked Questions
max-age). This prevents protocol downgrade attacks and cookie hijacking on insecure networks.default-src 'self' allows resources only from the same origin.X-Frame-Options prevents a page from being embedded inside an <iframe> on another site. This protects against clickjacking attacks, where an attacker tricks a user into clicking on an invisible element. Common values are DENY (never allow framing) and SAMEORIGIN (allow only from the same origin). It has been largely superseded by the CSP frame-ancestors directive.Cache-Control directives tell browsers and intermediate caches how to cache the response. max-age=3600 caches for 1 hour. no-cache means the browser must revalidate before using a cached copy. no-store means never cache (used for sensitive data). public allows CDNs to cache; private means only the browser may cache.HSTS) — forces HTTPS for a specified duration; Content-Security-Policy (CSP) — restricts which resources the browser may load, blocking XSS attacks; X-Frame-Options — prevents clickjacking by blocking your page from being framed; and X-Content-Type-Options: nosniff — stops browsers from MIME-sniffing a response away from the declared Content-Type. Adding all four significantly raises the security posture of any web application. Tools like securityheaders.com can grade your headers.Header directive (requires mod_headers): add Header always set X-Content-Type-Options "nosniff" to your .htaccess or virtual host config. In Nginx, use add_header in the server or location block: add_header X-Frame-Options "SAMEORIGIN" always;. The always keyword in both servers ensures the header is sent even on error responses. For PHP applications, you can also set headers in code with header('X-Content-Type-Options: nosniff'); before any output.max-age=N — cache the response for N seconds; no-cache — the browser must revalidate with the server before using a cached copy (it does cache it, despite the name); no-store — never cache the response at all (used for sensitive data like bank pages); must-revalidate — once the cache entry expires, do not serve stale; public — allows CDNs to cache; private — only the end-user's browser may cache. A typical static asset uses max-age=31536000, immutable; a sensitive page uses no-store.X-Content-Type-Options: nosniff disables MIME-sniffing entirely, forcing the browser to trust only the declared Content-Type. Always set an explicit Content-Type (e.g. application/json, text/html; charset=utf-8) on every response.About This HTTP Header Checker
This free HTTP Header Checker fetches the HTTP response headers for any public URL. It checks for important security headers, shows the full redirect chain, and highlights caching configuration. Results include a security score based on the presence of recommended headers.
Key Security Headers
| Header | Protects Against |
|---|---|
| HSTS | Protocol downgrade, MITM |
| CSP | XSS, data injection |
| X-Frame-Options | Clickjacking |
| X-Content-Type-Options | MIME sniffing |
| Referrer-Policy | Referrer leakage |
| Permissions-Policy | Feature abuse |
HTTP Status Codes
| Code | Meaning |
|---|---|
| 200 | OK — success |
| 301 | Moved Permanently |
| 302 | Found (temporary redirect) |
| 403 | Forbidden |
| 404 | Not Found |
| 500 | Internal Server Error |
Related Internet Tools
Related Articles
View all articles
HSTS Doesn't Protect the First Connection — Why the Preload List Exists and How to Use It Safely
HSTS tells browsers to use HTTPS only — but the first-ever connection to a site happens before HSTS takes effect, leaving a downgrade attack window. The HSTS preload list eliminates this by baking HTTPS-only policy directly into browsers before any connection. Here's why includeSubDomains is a commitment to all subdomains, how max-age=0 removes HSTS, and how HSTS silently fixes mixed content warnings for already-HSTS domains.
HTTP/2 and HTTP/3 Changed the Transport, Not the Headers — Here's What That Means in Practice
HTTP/2 and HTTP/3 changed the transport layer — binary framing, header compression, multiplexing, QUIC — but the headers you see in a response inspector are mostly the same HTTP/1.1 headers. Here's what HTTP/2's HPACK compression and multiplexing actually do, what the :method/:path/:status pseudo-headers mean, how to identify which HTTP version served a response, and what the Alt-Svc h3 header signals about HTTP/3 availability.
Cache-Control Demystified: Why "no-cache" Doesn't Mean "Don't Cache," and Other Misread Directives
"Cache-Control: no-cache" doesn't mean "don't cache this" — it means "cache it, but check with the server before using the cached copy, every time." This single misconception is responsible for much "why is this still cached" confusion. Here's the real no-cache vs no-store distinction, why private vs public matters for shared CDN caches, what must-revalidate does when the server is unreachable, and why Vary headers matter for content that differs by language or compression.
CORS Explained: Why It's a Server-Side Fix for a Browser-Side Error, and How to Debug It
A CORS error appears in the browser console as if it's a client-side problem — but it's actually caused by missing response headers from the server, which is why "it works in curl/Postman but fails in the browser" is the classic CORS symptom. Here's same-origin policy, the key CORS headers, simple vs preflighted requests, and a systematic debugging approach.
HTTP Caching Deep Dive: Cache-Control Directives, ETags, and Content Hashing Strategy
Content-hashed filenames with max-age=31536000 can eliminate network requests for returning users. Here's the complete HTTP caching strategy: Cache-Control directives in depth, ETags and conditional requests, the Vary header pitfall, CDN cache busting, and a practical caching strategy by resource type.
