HTTP header checker
Every response header, with the security ones called out.
Free and no signup. This one fetches the URL from our server; nothing about it is stored.
This one fetches the page from our server, so unlike the rest of these tools the URL does leave your browser. Nothing about it is stored.
About this tool
Response headers decide how a browser caches your page, whether it trusts the content type you declared, and how much of your URL leaks to the sites you link to. They are invisible in normal use, which is why they go unset for years on sites that are otherwise carefully built.
- Five security headers are checked by name, with what each one prevents. A missing Content-Security-Policy is the largest single gap on most sites.
- The absence of a content-encoding header means the response is uncompressed, which is usually a server misconfiguration rather than a decision.
- Cache-Control is worth reading closely on your static assets. Immutable, long-lived caching there is the cheapest performance change available.
- The full header list is shown too, because the interesting one is often a header you did not know was being set.
Questions
- Which security headers matter most?
- Content-Security-Policy does the most work, then HSTS. X-Content-Type-Options and Referrer-Policy are one line each and worth setting regardless.
- Do security headers affect SEO?
- Not directly. HSTS supports the https requirement, and a page that cannot be framed or MIME-sniffed is less likely to be compromised, which does affect rankings when it happens.
- Why does my site have no content-encoding?
- Compression is off, or a proxy is stripping it. Enabling gzip or brotli is usually a one-line change and cuts transfer size by most of its weight.