📋

HTTP Headers Checker

LOCAL · Browser-Only

View HTTP response headers for any URL

Enter URL

Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.

Try:

Why Check Security Headers?

Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.

·Share recipe

Was this tool helpful?

What is HTTP Headers Checker?

Free online HTTP headers checker to inspect HTTP response headers for any URL.

View all server response headers including content-type, cache-control, security headers (HSTS, CSP, X-Frame-Options), compression, cookies, and custom headers. Check security headers, audit your CSP and HSTS configuration, and see a security score based on recommended best practices. Handy after CDN changes, reverse-proxy edits, and routine hardening reviews, or just for debugging and performance work. No signup required.

How to Use HTTP Headers Checker

1Enter the URL to check
2Click Check to fetch the HTTP headers
3View all response headers in a formatted table
4Check the security score and missing header recommendations

Frequently Asked Questions

What are HTTP headers?

HTTP headers are metadata sent between browser and server with every request/response. They control caching, security, content type, compression, cookies, and more. They're invisible to users but critical for how websites work.

What security headers should I check for?

Key security headers: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Missing security headers leave your site vulnerable.

What is the security score?

The score rates your site's security headers on a scale. It checks for the presence and proper configuration of recommended security headers. A higher score means better header-level security.

How do I check if my CSP header is set?

Enter your URL and look for Content-Security-Policy in the response headers list. If it is present, the tool shows the full policy so you can confirm the directives. A missing or overly broad CSP is flagged as a security gap to fix.

Why does my site fail the HSTS check?

HSTS fails when the Strict-Transport-Security header is absent or its max-age is too short. Add the header on your HTTPS responses with a long max-age (such as 31536000 for a year) so browsers always connect over HTTPS for your domain.

Share this tool

Related Tools

⚡

Check website speed

Free online website speed test - analyze page load performance metrics

SEO

Seo audit tool

Free online SEO analyzer - analyze any website's SEO score and get actionable improvement tips

↪️

Redirect checker

Free online redirect chain checker - trace HTTP redirect chains and hops

🛡️

Is this link safe

Free online URL safety checker - scan URLs for malware, phishing, and security threats

🔗

Check broken links

Free online broken link checker - find broken links on web pages

npm

Npm package search

Free online NPM package explorer - search npm packages, check bundle sizes, and generate CDN links

🔎

Check dns records

Free online DNS lookup - query DNS records (A, MX, TXT, CNAME, NS)

🪝

Requestbin

Webhook tester online - generate temporary webhook URLs and inspect incoming HTTP requests for free

Keep reading: HTTP Status Codes Cheat Sheet and jwt claims and algorithms reference. Doing this in code instead? See the tool chain endpoints.

📋