Abdalla Elmorsi

HTTP Headers Checker

HTTP Headers Checker: Security Headers, Redirects and Status

Inspect the HTTP response headers of any public website. The tool follows redirects, shows the status code and IP address, and checks for the key security headers: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Missing security headers are an easy win for hardening a site.

Results will appear here.

How to use it

  1. Enter a URL, with or without https://.
  2. Press Check headers.
  3. Review the security header table and the full list of response headers.

Frequently asked questions

Which security header matters most?

HSTS and a Content-Security-Policy give the biggest protection. HSTS forces HTTPS, and CSP limits where scripts can load from.

Why can I not check an internal address?

Only public internet addresses are allowed. Private and internal ranges are blocked for safety.

Why is the redirect chain useful?

Long or looping redirect chains slow pages and can hide misconfigurations such as http to https to www hops.