Free HTTP Header Checker & Security Header Test

Every time a browser talks to a web server, the two exchange far more than the page you see on screen. Tucked into each request and response is a set of HTTP headers — small lines of metadata that quietly control caching, cookies, and how safe the connection actually is. Below is a practical walkthrough of the headers that matter most, what each one is, why it's important, and what a real value looks like.

Strict-Transport-Security (HSTS). This header tells the browser to only ever connect to a domain over HTTPS, never plain HTTP, for a set period of time. It matters because without it, a visitor's first request can still go out unencrypted for a split second, giving a network attacker a window to intercept or downgrade the connection. Example: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.

Content-Security-Policy (CSP). CSP tells the browser exactly which domains are allowed to serve scripts, styles, fonts, and images on the page. It's one of the strongest defenses against cross-site scripting, because even if an attacker sneaks a malicious script tag into a comment field or form input, the browser will simply refuse to execute anything from a source that isn't explicitly allowed. Example: Content-Security-Policy: default-src 'self'; script-src 'self' cdn.example.com.

X-Frame-Options. This header controls whether your page can be loaded inside an iframe on another site. It exists specifically to block clickjacking, where an attacker overlays your page inside an invisible frame and tricks a user into clicking a button they never intended to click, such as an "authorize payment" button. Example: X-Frame-Options: DENY or SAMEORIGIN.

X-Content-Type-Options. Browsers sometimes try to guess a file's actual type by inspecting its content rather than trusting the declared Content-Type — a behavior called MIME-sniffing. Attackers have exploited this to get a file disguised as an image executed as a script instead. This header switches that guessing off. Example: X-Content-Type-Options: nosniff.

Referrer-Policy. When a visitor clicks a link from your site to another, the browser can send along the URL they came from — sometimes including sensitive query parameters, tokens, or internal paths. Referrer-Policy limits exactly how much of that URL gets passed on, protecting both user privacy and internal data. Example: Referrer-Policy: strict-origin-when-cross-origin.

Permissions-Policy. This header restricts which browser features and hardware APIs — camera, microphone, geolocation, USB, and more — a page or its embedded content is allowed to request. It's important because it stops a compromised third-party script or ad from silently trying to access sensitive device features. Example: Permissions-Policy: camera=(), microphone=(), geolocation=(self).

Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Resource-Policy (CORP). These two newer headers isolate your page's browsing context and resources from other origins, closing off cross-origin attack techniques such as Spectre-style side-channel leaks and unauthorized resource embedding. Example: Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-site.

Cache-Control. Beyond performance, Cache-Control decides whether sensitive pages — like an account dashboard or checkout page — can be stored in a shared or browser cache where a later user on the same machine could potentially view them. Getting this wrong on a private page is a real data-exposure risk. Example: Cache-Control: no-store, max-age=0.

Server and X-Powered-By (information disclosure). These aren't protective headers — they're the opposite. They reveal your web server software, version, or backend framework to anyone who asks, which hands attackers a head start when searching for known vulnerabilities in that exact stack. The safest practice is to suppress or strip these headers entirely at the server or proxy level. Example of what you don't want to see: X-Powered-By: PHP/7.2.1.

Reading through these one by one in browser developer tools works, but it's slow and easy to get wrong across dozens of pages. This tool automates the whole process — enter a domain, or up to 20 at once, and it fetches the live response headers, checks them against this exact list, and returns a plain-language score and grade along with specific recommendations for anything missing. No request data is stored, logged to a database, or shared with anyone; results exist only for the current session and disappear the moment you leave the page.