HTTP Headers Checker

Analyze HTTP response headers, security policies, and caching configuration

About HTTP Headers

HTTP headers are metadata exchanged between a client (browser) and server with every request and response. They control caching, authentication, security policies, content negotiation, and more.

Key Security Headers

Strict-Transport-Security (HSTS): Forces browsers to use HTTPS, preventing downgrade attacks
Content-Security-Policy (CSP): Controls which resources can be loaded, preventing XSS attacks
X-Content-Type-Options: Prevents browsers from MIME-sniffing the content type
X-Frame-Options: Prevents clickjacking by controlling iframe embedding
Referrer-Policy: Controls how much referrer information is sent with requests

Caching Headers

Cache-Control: Directives for how and how long to cache content
ETag: Identifier for a specific version of a resource
Expires: Date/time after which the response is considered stale

Frequently Asked Questions

What are HTTP response headers?

HTTP headers are metadata sent by a web server along with the page content. They contain information about caching, security policies, content type, server software, cookies, and more. Analyzing headers helps debug issues and audit security.

What security headers should my website have?

Essential security headers include: Content-Security-Policy (prevents XSS), Strict-Transport-Security (forces HTTPS), X-Content-Type-Options (prevents MIME sniffing), X-Frame-Options (prevents clickjacking), and Referrer-Policy (controls referrer info).

What does the Cache-Control header do?

Cache-Control tells browsers and CDNs how long to store a copy of the response. Values like "max-age=3600" cache for 1 hour, "no-cache" requires revalidation, and "no-store" prevents caching entirely. Proper caching improves page load speed.

How do I check if my server headers are secure?

Enter your website URL in our HTTP Headers Checker. We analyze all response headers and flag missing security headers, misconfigured caching, information leakage (like server version exposure), and other issues.