Enter a web address to fetch it once from our server and list every response header. The security tab grades the important headers and shows the exact header to add for each gap.
HTTP Header Checker
View every HTTP response header of a website and get a graded security review (HSTS, CSP, clickjacking, cookies).
Check a website's HTTP response headers
See every header the server sends and a graded review of the security ones: HSTS, CSP, clickjacking, referrer and permissions policy, cookies and version leaks.
About the http header checker
See every HTTP header a website sends and get a graded review of its security headers. This HTTP header checker (also called a security headers test) shows HSTS, Content-Security-Policy, clickjacking protection, referrer and permissions policy, cookie flags and software version leaks, with the fix for each gap.
Also searched as: HTTP header checker · security headers checker · response headers viewer · website security headers test · HSTS checker · CSP checker · view HTTP headers online
The headers that matter
Strict-Transport-Security forces HTTPS. Content-Security-Policy limits what scripts and frames may load. X-Content-Type-Options stops MIME sniffing. X-Frame-Options or frame-ancestors prevents clickjacking. Referrer-Policy and Permissions-Policy limit data leaks and browser features. Together they remove whole classes of attacks at no cost.
How the grade works
Each missing or weak header lowers the score in proportion to its importance. The grade is a quick summary: A means the common protections are in place, F means most are missing. Every finding explains why it matters and what exact header to send.
Also useful for debugging
The full header list shows redirects, caching rules, compression, server software and cookies. It is a quick way to see why a page is not cached, why a CDN serves an old copy, or which proxy answered.
How this tool works and how to read the results
Frequently asked questions
How do I check the security headers of a website?
Enter the address and press Check headers. The Security grade tab reviews the important headers; the All headers tab lists everything the server sent.
What is HSTS and do I need it?
HTTP Strict Transport Security tells browsers to always use HTTPS for your domain. Yes: it blocks downgrade attacks. Start with a short max-age and raise it to a year.
Why is Content-Security-Policy so hard?
A strict policy can break inline scripts and third-party widgets. Start with Content-Security-Policy-Report-Only, collect the violations, fix them and then enforce the policy.
Does the tool store my results?
No. The request is made once from our server and only the headers are returned. The page body is never shown or kept.