See the status code and response headers of any URL, with a grade for caching and security headers.
How to use the HTTP header checker
- Enter a URL.
- Read the headers and the grade.
- Add the missing security headers in your server or hosting config.
Headers worth having
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and a frame policy cover the common attacks. A sensible Cache-Control keeps repeat visits fast.
How the grade works
The grade counts seven security headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. None gives an F, then E, D, C and B as you add more; five or six is an A and all seven an A+. It checks that a header exists, not that its value is strict. The caching panel shows Cache-Control, ETag, Last-Modified and Age; an Age value means a CDN served a cached copy. Server shows what the site announces about its software, or "hidden". The full list at the bottom can be copied.
Adding the missing headers
Most hosts set headers in one config file: vercel.json or next.config headers, _headers on Netlify, add_header in Nginx, Header set in Apache, or Transform Rules in Cloudflare. Safe starting values: X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, X-Frame-Options: SAMEORIGIN, and Strict-Transport-Security: max-age=31536000 once every subdomain serves HTTPS. Content-Security-Policy can break scripts and embeds, so start with Content-Security-Policy-Report-Only and tighten it over time.