Skip to content
Webmaster.ae
  • Loading…
Webmaster.ae
Start a projectPricing
Live check from our serversFree · no sign-up

HTTP headers and security headers checker

Enter a URL to see its HTTP response headers and a score for the six key security headers, including HSTS and Content-Security-Policy. Missing headers are listed so you can add them.

Result

Press “Check headers” to see the result here.

How do I use the HTTP headers and security headers checker?

  1. Enter the page URL.
  2. Press Check headers.
  3. Add any missing security headers in your server, CDN or framework config.

HTTP headers and security headers checker: frequently asked questions

Which security headers matter most?

Strict-Transport-Security and Content-Security-Policy give the most protection, followed by X-Content-Type-Options and a frame policy.

Can Cloudflare add these headers?

Yes, with Transform Rules, or you can set them in your web server or app.

What are HTTP headers?

Information sent with every web response: status code, content type, caching rules, security policies and more.

Which security headers should every site have?

Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and a frame-ancestors policy.

What does HSTS do?

It tells browsers to always use HTTPS for your domain, preventing downgrade attacks.

How do I add security headers?

In your web server or CDN configuration — Cloudflare, Nginx, Apache or your framework.

Why is my page not cached?

Check Cache-Control and cookies; responses that set cookies are often not cached by CDNs.

What does a 301 vs 302 status mean?

301 is a permanent redirect that passes SEO value; 302 is temporary.

Does the server header reveal too much?

Detailed version numbers help attackers. Hide or shorten them where you can.

Can I check any website?

Yes, for public URLs. Private and local addresses are blocked for safety.

Learn more