HTTP Headers Checker

The tool sends a request to the address you enter and shows everything the server replies with: the status code, every redirect hop, and the headers in the order they arrived. Long values are not cut off — a 2,000-character content security policy shows up in full.

Next to the raw list comes a breakdown of what each familiar header does and whether its value makes sense. Headers are grouped by purpose: security, caching, transfer, cookies, cross-origin access, and indexing.

Security score

Six security headers add up to 100 points: content security policy 25, HSTS 20, frame embedding protection 20, MIME-type protection 20, Permissions-Policy 10, and Referrer-Policy 5. A letter next to the score runs from A+ to F.

Half the points come off for lax settings: a policy with unsafe-inline exists on paper but barely protects against an injected script. Version disclosure blocks the top grade: a header like Server: nginx/1.18.0 tells an attacker which vulnerabilities to try first.

Subdomains and robots

For an https address, the tool also checks the http version: whether it redirects to https and with what code. It also reads X-Robots-Tag, which hides a page from search engines the same way a robots meta tag does — except it never appears in the page source, and such a block can take weeks to find.

You choose which user agent to present yourself as: some sites answer Google and Yandex robots differently from a regular browser. Check the exact URL you care about, not only the home page — the headers on a product page and in the cart are usually different.