Security

HTTP Headers

View response headers and audit security policies.

URL http or https (default https). Up to 3 redirects are followed.
https://www.mozilla.org/
Status: 200 HTTP/1.1 360 ms
B
Security grade?
Score
77 / 100
Status
200
Protocol?
HTTP/1.1
Latency?
360 ms
Redirect chain?
  1. 301 — https://mozilla.org/
  2. 200 — https://www.mozilla.org/
Security audit
  • pass Strict-Transport-Security? +25/25
    HSTS is set with a long max-age — browsers will refuse plaintext HTTP for the next 6+ months.
    max-age=31536000
  • warn Content-Security-Policy? +12/25
    CSP allows both unsafe-inline and unsafe-eval — XSS protection is largely defeated.
    img-src 'self' blog.mozilla.org data: images.ctfassets.net www.google-analytics.com www.googletagmanager.com www.mozilla.org; form-action 'self' https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org; font-src 'self' www.mozilla.org; frame-ancestors 'none'; connect-src 'self' *.analytics.google.com *.google-analytics.com *.googletagmanager.com analytics.google.com cdn.transcend.io google-analytics.com googletagmanager.com gtm.mozilla.org https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org o1069899.ingest.sentry.io o1069899.sentry.io region1.google-analytics.com telemetry.transcend.io telemetry.us.transcend.io transcend-cdn.com www.mozilla.org/submit/bedrock/; base-uri 'none'; object-src 'none'; default-src 'self' *.mozilla.org; style-src 'self' 'unsafe-inline' cdn.transcend.io transcend-cdn.com www.mozilla.org; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.google-analytics.com *.googletagmanager.com cdn.transcend.io google-analytics.com googletagmanager.com js.stripe.com s.ytimg.com tagmanager.google.com transcend-cdn.com www.mozilla.org www.youtube.com; frame-src 'self' accounts.firefox.com gtm.mozilla.org js.stripe.com www.google-analytics.com www.googletagmanager.com www.youtube.com; media-src 'self' assets.mozilla.net videos.cdn.mozilla.net www.mozilla.org; upgrade-insecure-requests
  • pass X-Frame-Options / frame-ancestors? +15/15
    Clickjacking is blocked — page cannot be embedded in third-party iframes.
    DENY
  • pass X-Content-Type-Options +10/10
    nosniff is set — browsers will not MIME-sniff non-script responses as JavaScript.
    nosniff
  • pass Referrer-Policy? +15/15
    Referrer policy keeps full URLs from leaking to third-party origins.
    strict-origin-when-cross-origin
  • fail Permissions-Policy? +0/10
    No Permissions-Policy — third-party iframes can request sensitive features without restriction.
Response headers
connection: keep-alive content-length: 48462 x-frame-options: DENY etag: "d0dafd76ef640d1710698ddd5407e3b4" content-security-policy-report-only: img-src 'self' blog.mozilla.org data: images.ctfassets.net www.google-analytics.com www.googletagmanager.com www.mozilla.org; form-action 'self' https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org; font-src 'self' www.mozilla.org; frame-ancestors 'none'; connect-src 'self' *.analytics.google.com *.google-analytics.com *.googletagmanager.com analytics.google.com cdn.transcend.io google-analytics.com googletagmanager.com gtm.mozilla.org https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org o1069899.ingest.sentry.io o1069899.sentry.io region1.google-analytics.com telemetry.transcend.io telemetry.us.transcend.io transcend-cdn.com www.mozilla.org/submit/bedrock/; base-uri 'none'; object-src 'none'; default-src 'self' *.mozilla.org; style-src 'self' 'unsafe-inline' cdn.transcend.io transcend-cdn.com www.mozilla.org; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.google-analytics.com *.googletagmanager.com cdn.transcend.io google-analytics.com googletagmanager.com js.stripe.com s.ytimg.com tagmanager.google.com transcend-cdn.com www.mozilla.org www.youtube.com; frame-src 'self' accounts.firefox.com gtm.mozilla.org js.stripe.com www.google-analytics.com www.googletagmanager.com www.youtube.com; media-src 'self' assets.mozilla.net videos.cdn.mozilla.net www.mozilla.org; upgrade-insecure-requests x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin content-type: text/html; charset=utf-8 cross-origin-opener-policy: same-origin expires: Sun, 26 Jul 2026 17:29:55 GMT server: granian x-backend-server: bedrock-74d9c74bff-mhktt.gcp-us-west1 cache-control: max-age=600 via: 1.1 google, 1.1 varnish, 1.1 varnish strict-transport-security: max-age=31536000 content-security-policy: img-src 'self' blog.mozilla.org data: images.ctfassets.net www.google-analytics.com www.googletagmanager.com www.mozilla.org; form-action 'self' https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org; font-src 'self' www.mozilla.org; frame-ancestors 'none'; connect-src 'self' *.analytics.google.com *.google-analytics.com *.googletagmanager.com analytics.google.com cdn.transcend.io google-analytics.com googletagmanager.com gtm.mozilla.org https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org o1069899.ingest.sentry.io o1069899.sentry.io region1.google-analytics.com telemetry.transcend.io telemetry.us.transcend.io transcend-cdn.com www.mozilla.org/submit/bedrock/; base-uri 'none'; object-src 'none'; default-src 'self' *.mozilla.org; style-src 'self' 'unsafe-inline' cdn.transcend.io transcend-cdn.com www.mozilla.org; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.google-analytics.com *.googletagmanager.com cdn.transcend.io google-analytics.com googletagmanager.com js.stripe.com s.ytimg.com tagmanager.google.com transcend-cdn.com www.mozilla.org www.youtube.com; frame-src 'self' accounts.firefox.com gtm.mozilla.org js.stripe.com www.google-analytics.com www.googletagmanager.com www.youtube.com; media-src 'self' assets.mozilla.net videos.cdn.mozilla.net www.mozilla.org; upgrade-insecure-requests x-clacks-overhead: GNU Terry Pratchett accept-ranges: bytes date: Sun, 26 Jul 2026 17:23:26 GMT age: 211 x-served-by: cache-fra-eddf8230094-FRA, cache-fra-eddf8230094-FRA, cache-fra-etou8220140-FRA x-cache: MISS, HIT x-cache-hits: 0, 1 x-timer: S1785086607.709110,VS0,VE4 vary: Accept-Language, Accept-Encoding
What does each field mean?

Field reference

Security grade

Aggregate score of security headers weighted by impact: HSTS and CSP carry the most weight. A+ requires all five headers correctly set; F means none are present. Use this as a quick first-glance metric, then dig into the per-header findings below.

HTTP protocol

HTTP/1.1 is the legacy text protocol. HTTP/2 multiplexes streams over one TCP connection (header compression, server push). HTTP/3 runs over QUIC (UDP) — better on lossy or mobile networks. Modern servers should expose at least HTTP/2.

Latency

Round-trip from our server to the target until the first response byte arrives. Not a CDN benchmark — geographic distance, TLS handshake, and server warm-up all factor in. Use it as a rough freshness signal, not as production performance data.

Redirect chain

A long chain (3+ redirects) hurts SEO and performance. The classic pattern is <code>http://example.com → https://example.com → https://www.example.com</code>: two hops, acceptable. Anything beyond five is misconfiguration.

Strict-Transport-Security (HSTS)

HSTS tells browsers "never connect to me over plain HTTP again". <code>max-age=15768000</code> (6 months) is the practical minimum; <code>includeSubDomains; preload</code> opts in to the global HSTS preload list. Once preloaded, you cannot opt out for ~12 months — set up everything else first.

Content-Security-Policy (CSP)

CSP whitelists where scripts, styles, images, and frames may load from. <code>default-src 'self'</code> is a sane baseline; nonce-based <code>script-src</code> is strongest. Watch out for <code>unsafe-inline</code> and <code>unsafe-eval</code> — they neuter most of CSP's XSS protection. Use report-uri / report-to for monitoring.

X-Frame-Options

Set <code>DENY</code> to disallow framing entirely, or <code>SAMEORIGIN</code> to allow only same-origin frames. Modern equivalent is <code>frame-ancestors</code> in CSP (richer syntax) — either of the two satisfies our audit.

Referrer-Policy

Determines what the browser sends in the <code>Referer</code> header. <code>strict-origin-when-cross-origin</code> (default in modern browsers) is a good baseline: full URL same-origin, only origin cross-origin, nothing on downgrade. <code>no-referrer</code> strips referrer entirely; <code>unsafe-url</code> leaks full URLs on downgrade — avoid.

Permissions-Policy

Successor to Feature-Policy. Lets you allow / deny browser APIs per-origin: <code>camera=(), microphone=(), geolocation=(self)</code>. Mostly defense-in-depth; enforced on iframes, so safer behavior for embedded content.

X-Content-Type-Options: nosniff

Without this header, browsers may execute a JSON response as JavaScript if "it looks like script". Setting <code>X-Content-Type-Options: nosniff</code> forces the declared Content-Type to be respected. Cheap, always safe to enable — there is no good reason to omit it.

About this tool

HTTP Headers fetches your URL with a real HTTPS request, captures every header in the response (and every intermediate response along any redirect chain), and runs the result through a security audit covering the modern hardening headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options / CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each header is checked for presence, value sanity, and best-practice gaps.

Beyond the audit, we list every header verbatim so you can confirm caching policy (Cache-Control, ETag, Vary), CDN tracing (CF-Ray, X-Cache, X-Served-By), compression (Content-Encoding: br/gzip), and any custom headers your stack emits. The HTTP method (GET or HEAD), HTTP version negotiated (HTTP/1.1, HTTP/2, HTTP/3), and TLS version are reported in the request bar.

When to use this tool

  • Security hardening. Before going live, confirm HSTS, CSP, and the rest are set with safe values — Mozilla Observatory baseline at minimum.
  • Cache debugging. See exactly what Cache-Control and Vary your CMS or framework emits — common cause of "old version sticking around".
  • Redirect chain audits. Spot accidental 302-then-301 chains, HTTP-to-HTTPS-to-different-host loops, and missing canonicalisation.
  • CDN behaviour. Confirm Cloudflare/Fastly/CloudFront is actually caching what you think it is by reading the Age, X-Cache, and CDN-specific headers.

What our security audit covers

For each of the six hardening headers we report: present or missing, the actual value, and a short verdict ("good", "needs tightening", "vulnerable"). HSTS without includeSubDomains, CSP with unsafe-inline, or Referrer-Policy left at default get flagged. We never tell you the "perfect" policy because every site is different — but we tell you which knobs are still at the factory setting.

Frequently asked questions

What is HSTS and why does it matter?

Strict-Transport-Security tells the browser "always use HTTPS for this domain, even if the user typed http:// or clicked an http:// link". Once set with a reasonable max-age (typically 31536000 = 1 year), it prevents SSL-stripping attacks on subsequent visits. Adding includeSubDomains extends the protection to every subdomain — strong default for most sites but make sure all of them really do support HTTPS first.

My CSP is missing — how dangerous is that?

Without CSP, any XSS hole in your site executes with full power: it can exfiltrate cookies, load attacker-controlled scripts, or rewrite the DOM. A starting CSP of default-src 'self' blocks the most common XSS payloads (inline scripts, external script loads) at near-zero cost. Tighter policies that ban inline scripts entirely require refactoring but provide much stronger protection.

Do you follow redirects?

Yes — up to five hops. Each step is shown with its method, status, location, and headers so you can spot mixed-protocol hops (HTTP→HTTPS), missing canonicalisation (apex vs www), or accidental loops. Most production sites should redirect once at most (HTTP → HTTPS), then serve content; more than two hops is usually a sign of overlapping rewrite rules.

Why does the tool show HTTP/2 even when I configured HTTP/3?

HTTP/3 (QUIC over UDP) requires the client to opt-in via the Alt-Svc header on the first connection. Our checker uses HTTP/2 over TCP by default, which is what most HTTP clients still do today; if your server advertises HTTP/3 in Alt-Svc, you will see that header in the result, but the response itself is still over HTTP/2. The presence of Alt-Svc is the right thing to look for.