HTTP Headers Checker

How to use

1. Enter the URL and select Check.
2. Review the security header checklist, then the full header list.

What this tool does

It lists the headers of the final response (cookie values are hidden) and checks for Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or frame-ancestors, Referrer-Policy and Permissions-Policy, plus caching and compression headers.

Why it matters

Headers control caching, compression and important browser security protections. They are invisible in the page, so a header checker is the quickest way to confirm your server or CDN configuration.

Common uses

• Verifying security headers after configuring them.
• Debugging caching and CDN behaviour.

Tips

• Use the Security Headers Generator to create the configuration lines for Apache, Nginx or PHP.

Limitations

Headers can differ between visitors, countries and logged-in users; this shows what our server received.

Troubleshooting

• “Could not connect” or “took too long”: the site may be down, slow, or blocking automated requests. Try again later or check it in your browser.
• “Certificate could not be verified”: the HTTPS certificate is expired, self-signed or issued for another domain. Visitors’ browsers will show a warning too.
• “Private or reserved network address”: the address points to a local or internal network, which this tool never contacts.
• “Limit reached”: checks are rate-limited to keep the service free and to avoid overloading other websites. Wait a few minutes.