What is an HTTP Header Checker?
Response headers control caching, security and behavior that never shows up in the page itself. Misconfigured headers cause anything from stale content to clickjacking exposure.
This tool fetches the URL exactly once (without following redirects), lists every response header, and grades the six security headers browsers care about most, with a fix suggestion for each one missing.
Frequently asked questions
Which security headers does the audit cover?
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.
Do missing security headers mean my site is hacked?
No: they are hardening layers, not proof of compromise. Each missing header is one browser-level defense you are not using.
Why does the tool show a 301 instead of my page?
It deliberately does not follow redirects, so you can see each hop’s own headers. Use the Redirect Checker to walk the whole chain.
Which header should I add first?
HSTS is the easiest win on an all-HTTPS site. CSP has the highest impact but needs testing: start it in report-only mode.