Security

HTTP Headers

View response headers and audit security policies.

URL http or https (default https). Up to 3 redirects are followed.

Try: github.com cloudflare.com example.com mozilla.org

https://www.cloudflare.com/

Status: 200 HTTP/1.1 850 ms

Security grade

Score

87 / 100

Status

200

Protocol

HTTP/1.1

Latency

850 ms

Redirect chain

301 — https://cloudflare.com/
200 — https://www.cloudflare.com/

Security audit

pass Strict-Transport-Security? +25/25

HSTS is set with a long max-age — browsers will refuse plaintext HTTP for the next 6+ months.

max-age=31536000; includeSubDomains
warn Content-Security-Policy? +12/25

CSP allows both unsafe-inline and unsafe-eval — XSS protection is largely defeated.

default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflareinsights.com https://static-staging.cloudflareinsights.com https://challenges.cloudflare.com https://*.onetrust.com https://cdn.cookielaw.org https://ot.www.cloudflare.com https://www.googletagmanager.com https://tagmanager.google.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://adservice.google.com https://cdn.bizible.com https://js.adsrvr.org https://*.marketo.net https://platform.twitter.com https://static.ads-twitter.com https://scripts.demandbase.com https://tag.demandbase.com https://*.6sc.co https://*.qualified.com https://snap.licdn.com https://bat.bing.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://analytics.google.com https://*.doubleclick.net https://www.googleadservices.com https://translate.googleapis.com https://cdn.bizible.com https://js.adsrvr.org https://*.marketo.net https://ads-twitter.com https://analytics.twitter.com https://*.twimg.com https://api.demandbase.com https://scripts.demandbase.com https://tag.demandbase.com https://tag-logger.demandbase.com https://api.company-target.com https://*.6sc.co https://epsilon.6sense.com https://*.qualified.com wss://*.qualified.com https://*.ads.linkedin.com https://www.linkedin.com https://bat.bing.com https:; frame-src https://*.adsrvr.org https://*.cloudflare.com https://*.videodelivery.net https://*.cloudflarestream.com https://www.googletagmanager.com https://*.qualified.com https://td.doubleclick.net https://bid.g.doubleclick.net https://9309168.fls.doubleclick.net https://9973066.fls.doubleclick.net https://s.company-target.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' blob:; child-src 'self' blob:; upgrade-insecure-requests
pass X-Frame-Options / frame-ancestors? +15/15

Clickjacking is blocked — page cannot be embedded in third-party iframes.

SAMEORIGIN
pass X-Content-Type-Options +10/10

nosniff is set — browsers will not MIME-sniff non-script responses as JavaScript.

nosniff
pass Referrer-Policy? +15/15

Referrer policy keeps full URLs from leaking to third-party origins.

strict-origin-when-cross-origin
pass Permissions-Policy? +10/10

Permissions policy restricts browser features (camera, mic, geolocation) for embeds.

geolocation=(), camera=(), microphone=()

Response headers

date: Sun, 26 Jul 2026 17:23:25 GMT content-type: text/html; charset=utf-8 transfer-encoding: chunked connection: keep-alive link: <https://www.cloudflare.com/.well-known/agents.json>; rel="api-catalog", <https://www.cloudflare.com/.well-known/webmcp.json>; rel="service-desc", <https://www.cloudflare.com/openapi.json>; rel="service-desc", <https://www.cloudflare.com/llms.txt>; rel="service-doc", <https://www.cloudflare.com/sitemap.xml>; rel="sitemap", </fonts/Kunst%20Grotesk%20Regular.woff2>; rel=preload; as=font; type="font/woff2"; crossorigin, </fonts/Kunst%20Grotesk%20Medium.woff2>; rel=preload; as=font; type="font/woff2"; crossorigin, <https://ot.www.cloudflare.com>; rel=preconnect; crossorigin, <https://imagedelivery.net>; rel=preconnect; crossorigin, </static/hero-poster.avif>; rel=preload; as=image; type="image/avif"; fetchpriority=high cache-control: public, max-age=10, s-maxage=10 strict-transport-security: max-age=31536000; includeSubDomains cf-placement: remote-MXP content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflareinsights.com https://static-staging.cloudflareinsights.com https://challenges.cloudflare.com https://*.onetrust.com https://cdn.cookielaw.org https://ot.www.cloudflare.com https://www.googletagmanager.com https://tagmanager.google.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://adservice.google.com https://cdn.bizible.com https://js.adsrvr.org https://*.marketo.net https://platform.twitter.com https://static.ads-twitter.com https://scripts.demandbase.com https://tag.demandbase.com https://*.6sc.co https://*.qualified.com https://snap.licdn.com https://bat.bing.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://analytics.google.com https://*.doubleclick.net https://www.googleadservices.com https://translate.googleapis.com https://cdn.bizible.com https://js.adsrvr.org https://*.marketo.net https://ads-twitter.com https://analytics.twitter.com https://*.twimg.com https://api.demandbase.com https://scripts.demandbase.com https://tag.demandbase.com https://tag-logger.demandbase.com https://api.company-target.com https://*.6sc.co https://epsilon.6sense.com https://*.qualified.com wss://*.qualified.com https://*.ads.linkedin.com https://www.linkedin.com https://bat.bing.com https:; frame-src https://*.adsrvr.org https://*.cloudflare.com https://*.videodelivery.net https://*.cloudflarestream.com https://www.googletagmanager.com https://*.qualified.com https://td.doubleclick.net https://bid.g.doubleclick.net https://9309168.fls.doubleclick.net https://9973066.fls.doubleclick.net https://s.company-target.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' blob:; child-src 'self' blob:; upgrade-insecure-requests cross-origin-opener-policy: unsafe-none cross-origin-resource-policy: cross-origin permissions-policy: geolocation=(), camera=(), microphone=() referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-served-by: marketing-site x-xss-protection: 1; mode=block x-rm: GW vary: accept-encoding set-cookie: __cf_bm=u3PWbOeyR7uXkc7Dm6fsL1yUwrI0.iHmiT7bJNr0jLc-1785086605.6172793-1.0.1.1-fwp.e7wO.X9wlqacz6G.Nv5UGNYuidt3Dy3lvour4NutSYJGr7k0xEeTRId.NZrOqApx_88DUKGaHBsS435Ul0L8NOesfjx.OlShaWxEB0vjuZZvU4Yt44wA_JV3hR8BJSRgUo6ARo4jJOwFGQwSJw; HttpOnly; SameSite=None; Secure; Path=/; Domain=www.cloudflare.com; Expires=Sun, 26 Jul 2026 17:53:25 GMT report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qU5wNa%2BAqDxE%2B4MaP5m2jGwWKZwzzAyP%2Fq7flIzSeFaBXQA7R2rMEZ%2FJO0N5cyw5WAsGdHptuBB6zNehjsqCBX6mwmG97TmgOLkvWai3fUVnTdO%2BvOrKtetjVX%2Fdz5%2FJVoll2w%3D%3D"}]} nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} server: cloudflare cf-ray: a21517951b0a4dbd-FRA alt-svc: h3=":443"; ma=86400

What does each field mean?

Field reference

Security grade

Aggregate score of security headers weighted by impact: HSTS and CSP carry the most weight. A+ requires all five headers correctly set; F means none are present. Use this as a quick first-glance metric, then dig into the per-header findings below.

HTTP protocol

HTTP/1.1 is the legacy text protocol. HTTP/2 multiplexes streams over one TCP connection (header compression, server push). HTTP/3 runs over QUIC (UDP) — better on lossy or mobile networks. Modern servers should expose at least HTTP/2.

Latency

Round-trip from our server to the target until the first response byte arrives. Not a CDN benchmark — geographic distance, TLS handshake, and server warm-up all factor in. Use it as a rough freshness signal, not as production performance data.

Redirect chain

A long chain (3+ redirects) hurts SEO and performance. The classic pattern is <code>http://example.com → https://example.com → https://www.example.com</code>: two hops, acceptable. Anything beyond five is misconfiguration.

Strict-Transport-Security (HSTS)

HSTS tells browsers "never connect to me over plain HTTP again". <code>max-age=15768000</code> (6 months) is the practical minimum; <code>includeSubDomains; preload</code> opts in to the global HSTS preload list. Once preloaded, you cannot opt out for ~12 months — set up everything else first.

Content-Security-Policy (CSP)

CSP whitelists where scripts, styles, images, and frames may load from. <code>default-src 'self'</code> is a sane baseline; nonce-based <code>script-src</code> is strongest. Watch out for <code>unsafe-inline</code> and <code>unsafe-eval</code> — they neuter most of CSP's XSS protection. Use report-uri / report-to for monitoring.

X-Frame-Options

Set <code>DENY</code> to disallow framing entirely, or <code>SAMEORIGIN</code> to allow only same-origin frames. Modern equivalent is <code>frame-ancestors</code> in CSP (richer syntax) — either of the two satisfies our audit.

Referrer-Policy

Determines what the browser sends in the <code>Referer</code> header. <code>strict-origin-when-cross-origin</code> (default in modern browsers) is a good baseline: full URL same-origin, only origin cross-origin, nothing on downgrade. <code>no-referrer</code> strips referrer entirely; <code>unsafe-url</code> leaks full URLs on downgrade — avoid.

Permissions-Policy

Successor to Feature-Policy. Lets you allow / deny browser APIs per-origin: <code>camera=(), microphone=(), geolocation=(self)</code>. Mostly defense-in-depth; enforced on iframes, so safer behavior for embedded content.

X-Content-Type-Options: nosniff

Without this header, browsers may execute a JSON response as JavaScript if "it looks like script". Setting <code>X-Content-Type-Options: nosniff</code> forces the declared Content-Type to be respected. Cheap, always safe to enable — there is no good reason to omit it.

About this tool

HTTP Headers fetches your URL with a real HTTPS request, captures every header in the response (and every intermediate response along any redirect chain), and runs the result through a security audit covering the modern hardening headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options / CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each header is checked for presence, value sanity, and best-practice gaps.

Beyond the audit, we list every header verbatim so you can confirm caching policy (Cache-Control, ETag, Vary), CDN tracing (CF-Ray, X-Cache, X-Served-By), compression (Content-Encoding: br/gzip), and any custom headers your stack emits. The HTTP method (GET or HEAD), HTTP version negotiated (HTTP/1.1, HTTP/2, HTTP/3), and TLS version are reported in the request bar.

When to use this tool

Security hardening. Before going live, confirm HSTS, CSP, and the rest are set with safe values — Mozilla Observatory baseline at minimum.
Cache debugging. See exactly what Cache-Control and Vary your CMS or framework emits — common cause of "old version sticking around".
Redirect chain audits. Spot accidental 302-then-301 chains, HTTP-to-HTTPS-to-different-host loops, and missing canonicalisation.
CDN behaviour. Confirm Cloudflare/Fastly/CloudFront is actually caching what you think it is by reading the Age, X-Cache, and CDN-specific headers.

What our security audit covers

For each of the six hardening headers we report: present or missing, the actual value, and a short verdict ("good", "needs tightening", "vulnerable"). HSTS without includeSubDomains, CSP with unsafe-inline, or Referrer-Policy left at default get flagged. We never tell you the "perfect" policy because every site is different — but we tell you which knobs are still at the factory setting.

Frequently asked questions

What is HSTS and why does it matter?

Strict-Transport-Security tells the browser "always use HTTPS for this domain, even if the user typed http:// or clicked an http:// link". Once set with a reasonable max-age (typically 31536000 = 1 year), it prevents SSL-stripping attacks on subsequent visits. Adding includeSubDomains extends the protection to every subdomain — strong default for most sites but make sure all of them really do support HTTPS first.

My CSP is missing — how dangerous is that?

Without CSP, any XSS hole in your site executes with full power: it can exfiltrate cookies, load attacker-controlled scripts, or rewrite the DOM. A starting CSP of default-src 'self' blocks the most common XSS payloads (inline scripts, external script loads) at near-zero cost. Tighter policies that ban inline scripts entirely require refactoring but provide much stronger protection.

Do you follow redirects?

Yes — up to five hops. Each step is shown with its method, status, location, and headers so you can spot mixed-protocol hops (HTTP→HTTPS), missing canonicalisation (apex vs www), or accidental loops. Most production sites should redirect once at most (HTTP → HTTPS), then serve content; more than two hops is usually a sign of overlapping rewrite rules.

Why does the tool show HTTP/2 even when I configured HTTP/3?

HTTP/3 (QUIC over UDP) requires the client to opt-in via the Alt-Svc header on the first connection. Our checker uses HTTP/2 over TCP by default, which is what most HTTP clients still do today; if your server advertises HTTP/3 in Alt-Svc, you will see that header in the result, but the response itself is still over HTTP/2. The presence of Alt-Svc is the right thing to look for.