Browse tools

HTTP Header Checker

See exactly what a web server sends back: every redirect, every header and what each one means. Get a security grade with the fixes that matter, plus cookie, caching, compression, certificate and HTTP/2 checks.

We request the page from our server in the UK, follow up to 10 redirects, and check whether the plain http:// address redirects to https://.

The security headers that matter

  • Strict-Transport-Security (HSTS): makes browsers always use HTTPS for your site, blocking downgrade and Wi-Fi interception attacks.
  • Content-Security-Policy: limits where scripts, styles and frames can load from, which stops most cross-site scripting (XSS) from doing damage.
  • X-Frame-Options or CSP frame-ancestors: stops other sites embedding yours in a hidden frame to trick clicks (clickjacking).
  • X-Content-Type-Options: nosniff: stops browsers guessing file types, so an uploaded file can't be run as a script.
  • Referrer-Policy and Permissions-Policy: limit what your pages leak to other sites and which browser features (camera, location) they can use.

Reading the results

  • Grade: A for all six key security headers, dropping a grade for each one missing. A+ also needs a strong CSP, a year-long HSTS and an http-to-https redirect.
  • Different results in your browser? Sites can answer differently by country, device (try "Safari on iPhone"), cookies or bot protection. Some firewalls block checkers like this one.
  • Timings are from our UK server, so they show the server's speed rather than yours.
  • Web hosts and control panels (Plesk, cPanel, Cloudflare, IIS) can add most security headers without code changes.
What is a redirect chain?

When you visit an address, the server can send you somewhere else with a 301 (permanent), 302 or 307 (temporary) or 308 (permanent) redirect. Common chains are http to https, and example.com to www.example.com. Each step adds a round trip, so keep chains to one or two redirects, and use permanent redirects for moves that won't change back.

Why does my site show "Server: nginx" or "X-Powered-By: PHP"?

Servers often announce their software and version. It doesn't make you vulnerable on its own, but it helps attackers pick exploits for old versions. Remove version numbers: for example server_tokens off; in nginx, expose_php = Off in PHP, and ServerTokens Prod in Apache.

Is it safe to check any site?

Yes. We make one normal page request (plus one for the http:// check), the same as a browser visiting, and don't download more than 5 MB. Private and internal network addresses are blocked.

More free tools