HTTP Header Checker
See the HTTP response headers a URL returns, including the security headers that protect its visitors.
HTTP response headers control caching, content type, redirects and — importantly — security. This tool fetches a URL and shows its headers, so you can confirm strong security headers are present: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options and Referrer-Policy.
Enter a full URL above (including https://) to inspect its headers.
Frequently asked questions
Which security headers matter most?
HSTS (forces HTTPS), CSP (limits where scripts/styles load from, mitigating XSS), X-Content-Type-Options: nosniff, and a sane Referrer-Policy are the high-value ones for most sites.
Why do I get an error for some sites?
Some hosts block automated requests or require specific TLS/SNI handling. This tool preserves SNI so it works with CDN-hosted sites.
What is HSTS?
HTTP Strict-Transport-Security tells browsers to only ever connect over HTTPS for a set period, preventing downgrade and cookie-hijacking attacks.