HTTP Headers
View response headers and audit security policies.
- 301 — https://mozilla.org/
- 200 — https://www.mozilla.org/
-
HSTS is set with a long max-age — browsers will refuse plaintext HTTP for the next 6+ months.max-age=31536000
-
CSP allows both unsafe-inline and unsafe-eval — XSS protection is largely defeated.img-src 'self' blog.mozilla.org data: images.ctfassets.net www.google-analytics.com www.googletagmanager.com www.mozilla.org; form-action 'self' https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org; font-src 'self' www.mozilla.org; frame-ancestors 'none'; connect-src 'self' *.analytics.google.com *.google-analytics.com *.googletagmanager.com analytics.google.com cdn.transcend.io google-analytics.com googletagmanager.com gtm.mozilla.org https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org o1069899.ingest.sentry.io o1069899.sentry.io region1.google-analytics.com telemetry.transcend.io telemetry.us.transcend.io transcend-cdn.com www.mozilla.org/submit/bedrock/; base-uri 'none'; object-src 'none'; default-src 'self' *.mozilla.org; style-src 'self' 'unsafe-inline' cdn.transcend.io transcend-cdn.com www.mozilla.org; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.google-analytics.com *.googletagmanager.com cdn.transcend.io google-analytics.com googletagmanager.com js.stripe.com s.ytimg.com tagmanager.google.com transcend-cdn.com www.mozilla.org www.youtube.com; frame-src 'self' accounts.firefox.com gtm.mozilla.org js.stripe.com www.google-analytics.com www.googletagmanager.com www.youtube.com; media-src 'self' assets.mozilla.net videos.cdn.mozilla.net www.mozilla.org; upgrade-insecure-requests
-
Clickjacking is blocked — page cannot be embedded in third-party iframes.DENY
-
pass X-Content-Type-Options +10/10nosniff is set — browsers will not MIME-sniff non-script responses as JavaScript.nosniff
-
Referrer policy keeps full URLs from leaking to third-party origins.strict-origin-when-cross-origin
-
No Permissions-Policy — third-party iframes can request sensitive features without restriction.
What does each field mean?
Field reference
Security grade
Aggregate score of security headers weighted by impact: HSTS and CSP carry the most weight. A+ requires all five headers correctly set; F means none are present. Use this as a quick first-glance metric, then dig into the per-header findings below.
HTTP protocol
HTTP/1.1 is the legacy text protocol. HTTP/2 multiplexes streams over one TCP connection (header compression, server push). HTTP/3 runs over QUIC (UDP) — better on lossy or mobile networks. Modern servers should expose at least HTTP/2.
Latency
Round-trip from our server to the target until the first response byte arrives. Not a CDN benchmark — geographic distance, TLS handshake, and server warm-up all factor in. Use it as a rough freshness signal, not as production performance data.
Redirect chain
A long chain (3+ redirects) hurts SEO and performance. The classic pattern is <code>http://example.com → https://example.com → https://www.example.com</code>: two hops, acceptable. Anything beyond five is misconfiguration.
Strict-Transport-Security (HSTS)
HSTS tells browsers "never connect to me over plain HTTP again". <code>max-age=15768000</code> (6 months) is the practical minimum; <code>includeSubDomains; preload</code> opts in to the global HSTS preload list. Once preloaded, you cannot opt out for ~12 months — set up everything else first.
Content-Security-Policy (CSP)
CSP whitelists where scripts, styles, images, and frames may load from. <code>default-src 'self'</code> is a sane baseline; nonce-based <code>script-src</code> is strongest. Watch out for <code>unsafe-inline</code> and <code>unsafe-eval</code> — they neuter most of CSP's XSS protection. Use report-uri / report-to for monitoring.
X-Frame-Options
Set <code>DENY</code> to disallow framing entirely, or <code>SAMEORIGIN</code> to allow only same-origin frames. Modern equivalent is <code>frame-ancestors</code> in CSP (richer syntax) — either of the two satisfies our audit.
Referrer-Policy
Determines what the browser sends in the <code>Referer</code> header. <code>strict-origin-when-cross-origin</code> (default in modern browsers) is a good baseline: full URL same-origin, only origin cross-origin, nothing on downgrade. <code>no-referrer</code> strips referrer entirely; <code>unsafe-url</code> leaks full URLs on downgrade — avoid.
Permissions-Policy
Successor to Feature-Policy. Lets you allow / deny browser APIs per-origin: <code>camera=(), microphone=(), geolocation=(self)</code>. Mostly defense-in-depth; enforced on iframes, so safer behavior for embedded content.
X-Content-Type-Options: nosniff
Without this header, browsers may execute a JSON response as JavaScript if "it looks like script". Setting <code>X-Content-Type-Options: nosniff</code> forces the declared Content-Type to be respected. Cheap, always safe to enable — there is no good reason to omit it.
About this tool
HTTP Headers fetches your URL with a real HTTPS request, captures every header in the response (and every intermediate response along any redirect chain), and runs the result through a security audit covering the modern hardening headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options / CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each header is checked for presence, value sanity, and best-practice gaps.
Beyond the audit, we list every header verbatim so you can confirm caching policy (Cache-Control, ETag, Vary), CDN tracing (CF-Ray, X-Cache, X-Served-By), compression (Content-Encoding: br/gzip), and any custom headers your stack emits. The HTTP method (GET or HEAD), HTTP version negotiated (HTTP/1.1, HTTP/2, HTTP/3), and TLS version are reported in the request bar.
When to use this tool
- Security hardening. Before going live, confirm HSTS, CSP, and the rest are set with safe values — Mozilla Observatory baseline at minimum.
- Cache debugging. See exactly what
Cache-ControlandVaryyour CMS or framework emits — common cause of "old version sticking around". - Redirect chain audits. Spot accidental 302-then-301 chains, HTTP-to-HTTPS-to-different-host loops, and missing canonicalisation.
- CDN behaviour. Confirm Cloudflare/Fastly/CloudFront is actually caching what you think it is by reading the
Age,X-Cache, and CDN-specific headers.
What our security audit covers
For each of the six hardening headers we report: present or missing, the actual value, and a short verdict ("good", "needs tightening", "vulnerable"). HSTS withoutincludeSubDomains, CSP with unsafe-inline, or Referrer-Policy left at default get flagged. We never tell you the "perfect" policy because every site is different — but we tell you which knobs are still at the factory setting.
Frequently asked questions
What is HSTS and why does it matter?
max-age (typically 31536000 = 1 year), it prevents SSL-stripping attacks on subsequent visits. Adding includeSubDomains extends the protection to every subdomain — strong default for most sites but make sure all of them really do support HTTPS first.
My CSP is missing — how dangerous is that?
default-src 'self' blocks the most common XSS payloads (inline scripts, external script loads) at near-zero cost. Tighter policies that ban inline scripts entirely require refactoring but provide much stronger protection.
Do you follow redirects?
Why does the tool show HTTP/2 even when I configured HTTP/3?
Alt-Svc header on the first connection. Our checker uses HTTP/2 over TCP by default, which is what most HTTP clients still do today; if your server advertises HTTP/3 in Alt-Svc, you will see that header in the result, but the response itself is still over HTTP/2. The presence of Alt-Svc is the right thing to look for.