How to check HTTP headers
- Enter the address of a public page.
- Choose whether to follow redirects, then select Check headers.
- Read each step and the advice on the security headers.
Examples
A move from http to https. A site that sends visitors to its secure address shows two steps: 301 Moved Permanently with a Location header pointing to the https address, then 200 OK. Each step lists its own headers.
A short HSTS time. Strict-Transport-Security: max-age=86400 is marked Check, because browsers keep to https for only 1 day. max-age=31536000, one year, is the usual choice.
An inline-script policy. Content-Security-Policy: script-src 'self' 'unsafe-inline' is flagged, because injected inline scripts could run. Adding a nonce or a hash clears the warning, since browsers that support them then ignore 'unsafe-inline'.
No frame protection. A page with neither frame-ancestors nor X-Frame-Options is marked Missing, with the advice to add frame-ancestors 'self' or X-Frame-Options: SAMEORIGIN.
About this tool
Enter a page address to see what the server sends back before the page itself: the status code, every response header and each redirect on the way. Redirects are followed one step at a time, so you see every hop. The final answer's security headers are then checked, including Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, frame-ancestors, Referrer-Policy and Permissions-Policy, each with plain advice.
Common questions
Why isn't Strict-Transport-Security checked on my http address?
Browsers ignore that header over plain http. Move the site to https first, then send the header on the https answers.
Do I need both X-Frame-Options and frame-ancestors?
frame-ancestors in Content-Security-Policy is the newer way, and browsers that support it ignore X-Frame-Options. Sending both still covers very old browsers.
Why are the headers different from what my browser sees?
The request comes from this site's server, without your cookies or login. Some sites answer differently by country, device or browser.
Is a missing Referrer-Policy a problem?
Not usually. Browsers then use strict-origin-when-cross-origin, which sends other sites only your domain. Set the header if you want a stricter policy.
Is it free to use?
Yes. There's no sign-up, and you can use it as often as you like.
Do I need to install anything?
No. It works in your browser on a computer or a phone.
Is what I enter kept?
It's only used to get your result. Some public answers, such as the branches for a pincode, are kept for a while so the next lookup is quicker, but nothing links them to you.