HTTP Header Check Online
Inspect HTTP and security headers of any website — Content-Security-Policy, HSTS, X-Frame-Options, server info and caching at a glance.
Articles related to this tool
How the HTTP Header Check Works
Our HTTP header check fetches the publicly accessible HTTP response headers of the entered URL and evaluates them according to security criteria. The rating is based on the presence of important security headers such as HSTS, CSP, X-Frame-Options and others. The result shows you at a glance which headers are missing and how to improve your web server configuration.
Which HTTP headers actually matter for security?
Every web server response contains headers — metadata the browser evaluates before rendering content. Some of them directly determine whether your site is protected against typical attack classes like clickjacking, cross-site scripting (XSS) or mixed-content injection. The six most important headers and their effect:
- Content-Security-Policy (CSP) — defines from which domains scripts, styles and images may be loaded. Protection against XSS and code injection.
- Strict-Transport-Security (HSTS) — forces browsers onto HTTPS for a defined period. Prevents SSL-stripping attacks.
- X-Frame-Options — prevents your page from being loaded inside an
iframeon foreign domains. Protection against clickjacking. - X-Content-Type-Options: nosniff — prevents MIME-sniffing by the browser. Stops a JS file disguised as an image from suddenly being executed.
- Referrer-Policy — controls what referrer information is sent when users click external links. Privacy-relevant.
- Permissions-Policy — disables browser APIs (camera, microphone, geolocation) for the page when they are not needed.
How to read our score
We award a score from A to F, based on the number and quality of security headers set. An A means: all six headers are cleanly configured. A D or F usually means: HSTS and/or CSP are missing — those are the two strongest-impact headers. Improving from D to B typically takes two lines in your server config; reaching an A often requires 30 minutes of CSP-directive fine-tuning.
Typical use cases
Webmasters check their own site before and after each deploy. Development teams use the tool during code review for pull requests that touch the server config. IT-responsible staff scan critical services regularly — many compliance frameworks (PCI-DSS, ISO 27001 BCM) expect documented security headers. For deeper background see our article Ports and Firewalls and the glossary entries on HSTS and TLS.
Frequently Asked Questions about HTTP Header Check
What are HTTP headers?
HTTP headers are metadata exchanged with every request between browser and server. They contain information about content type, caching rules, security policies and server details. Security headers like HSTS, CSP and X-Frame-Options protect against common attacks.
Which security headers are important?
The most important ones are: Strict-Transport-Security (HSTS) enforces HTTPS, Content-Security-Policy (CSP) prevents XSS attacks, X-Frame-Options protects against clickjacking, X-Content-Type-Options prevents MIME sniffing, and Referrer-Policy controls which information is passed to other websites.
How do I improve my security rating?
Add missing security headers to your web server configuration (Apache .htaccess or Nginx). Start with HSTS and X-Content-Type-Options as these are the easiest to implement. Test again with our tool after each change.