Security

HTTP Headers

View response headers and audit security policies.

URL http or https (default https). Up to 3 redirects are followed.

Try: github.com cloudflare.com example.com mozilla.org

https://example.com/

Status: 200 HTTP/1.1 102 ms

Security grade

Score

0 / 100

Status

200

Protocol

HTTP/1.1

Latency

102 ms

Security audit

fail Strict-Transport-Security? +0/25

No HSTS header — a downgrade attack on a public Wi-Fi can redirect the user to plaintext HTTP.
fail Content-Security-Policy? +0/25

No CSP — a single XSS bug can execute arbitrary scripts on this origin.
fail X-Frame-Options / frame-ancestors? +0/15

Page can be framed by any site — vulnerable to clickjacking.
fail X-Content-Type-Options +0/10

nosniff is missing — IE/old-Edge may execute disguised scripts based on content sniffing.
fail Referrer-Policy? +0/15

No Referrer-Policy — full URLs (including query strings) leak to every clicked link.
fail Permissions-Policy? +0/10

No Permissions-Policy — third-party iframes can request sensitive features without restriction.

Response headers

date: Sun, 26 Jul 2026 17:21:09 GMT content-type: text/html transfer-encoding: chunked connection: keep-alive server: cloudflare last-modified: Tue, 21 Jul 2026 07:16:00 GMT allow: GET, HEAD accept-ranges: bytes age: 1 cf-cache-status: HIT cf-ray: a215143f890cd361-FRA

What does each field mean?

Field reference

Security grade

Aggregate score of security headers weighted by impact: HSTS and CSP carry the most weight. A+ requires all five headers correctly set; F means none are present. Use this as a quick first-glance metric, then dig into the per-header findings below.

HTTP protocol

HTTP/1.1 is the legacy text protocol. HTTP/2 multiplexes streams over one TCP connection (header compression, server push). HTTP/3 runs over QUIC (UDP) — better on lossy or mobile networks. Modern servers should expose at least HTTP/2.

Latency

Round-trip from our server to the target until the first response byte arrives. Not a CDN benchmark — geographic distance, TLS handshake, and server warm-up all factor in. Use it as a rough freshness signal, not as production performance data.

Redirect chain

A long chain (3+ redirects) hurts SEO and performance. The classic pattern is <code>http://example.com → https://example.com → https://www.example.com</code>: two hops, acceptable. Anything beyond five is misconfiguration.

Strict-Transport-Security (HSTS)

HSTS tells browsers "never connect to me over plain HTTP again". <code>max-age=15768000</code> (6 months) is the practical minimum; <code>includeSubDomains; preload</code> opts in to the global HSTS preload list. Once preloaded, you cannot opt out for ~12 months — set up everything else first.

Content-Security-Policy (CSP)

CSP whitelists where scripts, styles, images, and frames may load from. <code>default-src 'self'</code> is a sane baseline; nonce-based <code>script-src</code> is strongest. Watch out for <code>unsafe-inline</code> and <code>unsafe-eval</code> — they neuter most of CSP's XSS protection. Use report-uri / report-to for monitoring.

X-Frame-Options

Set <code>DENY</code> to disallow framing entirely, or <code>SAMEORIGIN</code> to allow only same-origin frames. Modern equivalent is <code>frame-ancestors</code> in CSP (richer syntax) — either of the two satisfies our audit.

Referrer-Policy

Determines what the browser sends in the <code>Referer</code> header. <code>strict-origin-when-cross-origin</code> (default in modern browsers) is a good baseline: full URL same-origin, only origin cross-origin, nothing on downgrade. <code>no-referrer</code> strips referrer entirely; <code>unsafe-url</code> leaks full URLs on downgrade — avoid.

Permissions-Policy

Successor to Feature-Policy. Lets you allow / deny browser APIs per-origin: <code>camera=(), microphone=(), geolocation=(self)</code>. Mostly defense-in-depth; enforced on iframes, so safer behavior for embedded content.

X-Content-Type-Options: nosniff

Without this header, browsers may execute a JSON response as JavaScript if "it looks like script". Setting <code>X-Content-Type-Options: nosniff</code> forces the declared Content-Type to be respected. Cheap, always safe to enable — there is no good reason to omit it.

About this tool

HTTP Headers fetches your URL with a real HTTPS request, captures every header in the response (and every intermediate response along any redirect chain), and runs the result through a security audit covering the modern hardening headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options / CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each header is checked for presence, value sanity, and best-practice gaps.

Beyond the audit, we list every header verbatim so you can confirm caching policy (Cache-Control, ETag, Vary), CDN tracing (CF-Ray, X-Cache, X-Served-By), compression (Content-Encoding: br/gzip), and any custom headers your stack emits. The HTTP method (GET or HEAD), HTTP version negotiated (HTTP/1.1, HTTP/2, HTTP/3), and TLS version are reported in the request bar.

When to use this tool

Security hardening. Before going live, confirm HSTS, CSP, and the rest are set with safe values — Mozilla Observatory baseline at minimum.
Cache debugging. See exactly what Cache-Control and Vary your CMS or framework emits — common cause of "old version sticking around".
Redirect chain audits. Spot accidental 302-then-301 chains, HTTP-to-HTTPS-to-different-host loops, and missing canonicalisation.
CDN behaviour. Confirm Cloudflare/Fastly/CloudFront is actually caching what you think it is by reading the Age, X-Cache, and CDN-specific headers.

What our security audit covers

For each of the six hardening headers we report: present or missing, the actual value, and a short verdict ("good", "needs tightening", "vulnerable"). HSTS without includeSubDomains, CSP with unsafe-inline, or Referrer-Policy left at default get flagged. We never tell you the "perfect" policy because every site is different — but we tell you which knobs are still at the factory setting.

Frequently asked questions

What is HSTS and why does it matter?

Strict-Transport-Security tells the browser "always use HTTPS for this domain, even if the user typed http:// or clicked an http:// link". Once set with a reasonable max-age (typically 31536000 = 1 year), it prevents SSL-stripping attacks on subsequent visits. Adding includeSubDomains extends the protection to every subdomain — strong default for most sites but make sure all of them really do support HTTPS first.

My CSP is missing — how dangerous is that?

Without CSP, any XSS hole in your site executes with full power: it can exfiltrate cookies, load attacker-controlled scripts, or rewrite the DOM. A starting CSP of default-src 'self' blocks the most common XSS payloads (inline scripts, external script loads) at near-zero cost. Tighter policies that ban inline scripts entirely require refactoring but provide much stronger protection.

Do you follow redirects?

Yes — up to five hops. Each step is shown with its method, status, location, and headers so you can spot mixed-protocol hops (HTTP→HTTPS), missing canonicalisation (apex vs www), or accidental loops. Most production sites should redirect once at most (HTTP → HTTPS), then serve content; more than two hops is usually a sign of overlapping rewrite rules.

Why does the tool show HTTP/2 even when I configured HTTP/3?

HTTP/3 (QUIC over UDP) requires the client to opt-in via the Alt-Svc header on the first connection. Our checker uses HTTP/2 over TCP by default, which is what most HTTP clients still do today; if your server advertises HTTP/3 in Alt-Svc, you will see that header in the result, but the response itself is still over HTTP/2. The presence of Alt-Svc is the right thing to look for.