HTTP Header Checker

Every HTTP response carries headers before its body: metadata describing what was sent, how it may be cached, and what the browser is allowed to do with it. They are invisible in normal browsing but decide a great deal about how a page behaves.

The redirect chain is often the most immediately useful part. A request for a bare http address on a well-configured site usually becomes a 301 to https and then a 200, and seeing each hop makes it obvious when a site has an accidental loop, a redirect through the wrong hostname, or a chain several hops longer than it needs to be. Each extra hop is a full round trip before anything renders.

Among the security headers, Strict-Transport-Security and Content-Security-Policy do the heaviest lifting. HSTS tells the browser to use HTTPS for this site from now on, closing the window where a first plain-http request could be intercepted. CSP restricts where scripts and styles may load from, and is the main structural defence against cross-site scripting.

Clickjacking protection is the one case where a missing header is not necessarily a problem. X-Frame-Options was the original way to stop a page being embedded in someone else's frame, but a Content-Security-Policy frame-ancestors directive does the same job, takes precedence in modern browsers, and is the more expressive of the two. A site setting only the CSP directive is protected, so this tool counts that as covered rather than reporting it missing.

A word on what a header check can and cannot tell you. It reports what the server sent for this one request. It cannot tell you whether a Content-Security-Policy is actually strict enough, whether the caching directives suit the content, or whether the site is secure in any broader sense.