HTTP Headers
View response headers and audit security policies.
-
HSTS is set with a long max-age — browsers will refuse plaintext HTTP for the next 6+ months.max-age=31536000; includeSubdomains; preload
-
CSP is set with reasonable defaults — script and style sources are restricted.default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
-
Clickjacking is blocked — page cannot be embedded in third-party iframes.deny
-
pass X-Content-Type-Options +10/10nosniff is set — browsers will not MIME-sniff non-script responses as JavaScript.nosniff
-
Referrer policy leaks parts of the URL cross-origin — switch to strict-origin-when-cross-origin.origin-when-cross-origin, strict-origin-when-cross-origin
-
No Permissions-Policy — third-party iframes can request sensitive features without restriction.
What does each field mean?
Field reference
Security grade
Aggregate score of security headers weighted by impact: HSTS and CSP carry the most weight. A+ requires all five headers correctly set; F means none are present. Use this as a quick first-glance metric, then dig into the per-header findings below.
HTTP protocol
HTTP/1.1 is the legacy text protocol. HTTP/2 multiplexes streams over one TCP connection (header compression, server push). HTTP/3 runs over QUIC (UDP) — better on lossy or mobile networks. Modern servers should expose at least HTTP/2.
Latency
Round-trip from our server to the target until the first response byte arrives. Not a CDN benchmark — geographic distance, TLS handshake, and server warm-up all factor in. Use it as a rough freshness signal, not as production performance data.
Redirect chain
A long chain (3+ redirects) hurts SEO and performance. The classic pattern is <code>http://example.com → https://example.com → https://www.example.com</code>: two hops, acceptable. Anything beyond five is misconfiguration.
Strict-Transport-Security (HSTS)
HSTS tells browsers "never connect to me over plain HTTP again". <code>max-age=15768000</code> (6 months) is the practical minimum; <code>includeSubDomains; preload</code> opts in to the global HSTS preload list. Once preloaded, you cannot opt out for ~12 months — set up everything else first.
Content-Security-Policy (CSP)
CSP whitelists where scripts, styles, images, and frames may load from. <code>default-src 'self'</code> is a sane baseline; nonce-based <code>script-src</code> is strongest. Watch out for <code>unsafe-inline</code> and <code>unsafe-eval</code> — they neuter most of CSP's XSS protection. Use report-uri / report-to for monitoring.
X-Frame-Options
Set <code>DENY</code> to disallow framing entirely, or <code>SAMEORIGIN</code> to allow only same-origin frames. Modern equivalent is <code>frame-ancestors</code> in CSP (richer syntax) — either of the two satisfies our audit.
Referrer-Policy
Determines what the browser sends in the <code>Referer</code> header. <code>strict-origin-when-cross-origin</code> (default in modern browsers) is a good baseline: full URL same-origin, only origin cross-origin, nothing on downgrade. <code>no-referrer</code> strips referrer entirely; <code>unsafe-url</code> leaks full URLs on downgrade — avoid.
Permissions-Policy
Successor to Feature-Policy. Lets you allow / deny browser APIs per-origin: <code>camera=(), microphone=(), geolocation=(self)</code>. Mostly defense-in-depth; enforced on iframes, so safer behavior for embedded content.
X-Content-Type-Options: nosniff
Without this header, browsers may execute a JSON response as JavaScript if "it looks like script". Setting <code>X-Content-Type-Options: nosniff</code> forces the declared Content-Type to be respected. Cheap, always safe to enable — there is no good reason to omit it.
About this tool
HTTP Headers fetches your URL with a real HTTPS request, captures every header in the response (and every intermediate response along any redirect chain), and runs the result through a security audit covering the modern hardening headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options / CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each header is checked for presence, value sanity, and best-practice gaps.
Beyond the audit, we list every header verbatim so you can confirm caching policy (Cache-Control, ETag, Vary), CDN tracing (CF-Ray, X-Cache, X-Served-By), compression (Content-Encoding: br/gzip), and any custom headers your stack emits. The HTTP method (GET or HEAD), HTTP version negotiated (HTTP/1.1, HTTP/2, HTTP/3), and TLS version are reported in the request bar.
When to use this tool
- Security hardening. Before going live, confirm HSTS, CSP, and the rest are set with safe values — Mozilla Observatory baseline at minimum.
- Cache debugging. See exactly what
Cache-ControlandVaryyour CMS or framework emits — common cause of "old version sticking around". - Redirect chain audits. Spot accidental 302-then-301 chains, HTTP-to-HTTPS-to-different-host loops, and missing canonicalisation.
- CDN behaviour. Confirm Cloudflare/Fastly/CloudFront is actually caching what you think it is by reading the
Age,X-Cache, and CDN-specific headers.
What our security audit covers
For each of the six hardening headers we report: present or missing, the actual value, and a short verdict ("good", "needs tightening", "vulnerable"). HSTS withoutincludeSubDomains, CSP with unsafe-inline, or Referrer-Policy left at default get flagged. We never tell you the "perfect" policy because every site is different — but we tell you which knobs are still at the factory setting.
Frequently asked questions
What is HSTS and why does it matter?
max-age (typically 31536000 = 1 year), it prevents SSL-stripping attacks on subsequent visits. Adding includeSubDomains extends the protection to every subdomain — strong default for most sites but make sure all of them really do support HTTPS first.
My CSP is missing — how dangerous is that?
default-src 'self' blocks the most common XSS payloads (inline scripts, external script loads) at near-zero cost. Tighter policies that ban inline scripts entirely require refactoring but provide much stronger protection.
Do you follow redirects?
Why does the tool show HTTP/2 even when I configured HTTP/3?
Alt-Svc header on the first connection. Our checker uses HTTP/2 over TCP by default, which is what most HTTP clients still do today; if your server advertises HTTP/3 in Alt-Svc, you will see that header in the result, but the response itself is still over HTTP/2. The presence of Alt-Svc is the right thing to look for.