HTTP Headers Checker

View a website's security, cache and server headers — grouped and explained, with a clear pass/warning/missing status for every security header.

What is an HTTP headers checker?

An HTTP headers checker shows the hidden information a web server sends with every page. HTTP headers are lines of metadata that arrive before the content itself. They tell the browser what type of file is coming, how long it may be cached, which server sent it and which security rules to apply. Visitors never see them, but they shape how a site behaves.

This tool fetches a page's response headers, groups the important ones and explains them, and also lists every header received.

How the HTTP headers check works

The tool requests the address you enter, adding https:// if needed, and follows up to five redirects to the final page. It reads the headers from that final response and sorts them into three groups: security, cache and delivery, and server details. A full table of every header is available underneath in a collapsible section.

Security headers

Six headers are checked: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. Each is marked Present, Missing or Warning. A warning flags a value that does not work as intended, such as HSTS with no max-age, a max-age of 0, or a policy that allows every source.

How to use the HTTP headers checker

  1. Enter a domain or a full page address.
  2. Press Check Headers.
  3. Read the security summary, then the cache and server groups.
  4. Open "All response headers" to see the complete list exactly as received.

Reading the HTTP header results

Cache and delivery

Cache-Control and Expires say how long browsers and CDNs may store the response. ETag lets a browser ask whether its stored copy is still current. Age shows how long a cache has held the response, and Content-Encoding shows compression such as gzip or Brotli.

Server and technical

Server names the software if the site discloses it. Date is the server's clock, Content-Type the kind of content and character set, and Content-Length the size in bytes when it is sent.

"Not sent" simply means the server did not include that header.

Request headers and response headers

Headers travel in both directions. Your browser sends request headers, such as User-Agent, Accept-Language and cookies, to describe itself and what it wants. The server replies with response headers. This tool shows the response headers, which are the ones a site owner controls and the ones that decide caching, security and content type.

Headers added by a CDN

When a site uses a CDN, some headers come from the CDN rather than the server, for example CF-Cache-Status on Cloudflare or X-Cache on several other networks. They show whether the page was served from the CDN's cache, a hit, or fetched from the origin server, a miss.

Common uses

  • Checking that caching works after setting up a CDN.
  • Confirming new security headers are live after a server change.
  • Debugging why a browser shows an old version of a page.
  • Seeing whether compression is switched on.

Common problems and fixes

Security headers are missing. Add them in your web server configuration, your CDN settings or your hosting control panel. Start with X-Content-Type-Options and Referrer-Policy, which rarely break anything.

Pages update slowly for visitors. A long max-age in Cache-Control lets browsers keep old copies. Use shorter times for HTML and longer ones for versioned files.

Headers differ from what you configured. A CDN or proxy in front of the server can add, remove or change headers. Check its settings as well.

Related tools

Frequently asked questions

What are HTTP headers?

HTTP headers are name and value pairs sent before the content of a web page. Response headers from the server describe the content, set caching rules, identify the server and apply security policies in the browser. They are invisible to visitors, but browsers, search engines and CDNs all read them.

Which HTTP headers matter most for security?

Strict-Transport-Security forces HTTPS, Content-Security-Policy limits where scripts and other content can load from, and X-Content-Type-Options stops browsers guessing file types. X-Frame-Options, Referrer-Policy and Permissions-Policy add further protection. This tool checks all six and marks each as present, missing or misconfigured.

Why does a header show "Not sent"?

The server did not include that header in its response. For optional headers such as ETag or Age, that is normal. For security headers it usually means they have not been configured yet. Some CDNs and proxies also remove headers, so check those settings if you expected the header to appear.

How do I add HTTP headers to my website?

It depends on your setup. On Apache you can use the Header directive in the configuration or an .htaccess file, and on Nginx the add_header directive. Many hosts, CDNs and content management system plugins also offer header settings. Test changes on one page first, especially Content-Security-Policy.

Which page do the headers come from?

From the final page after any redirects. If you enter http://example.com and it redirects to https://www.example.com, the headers shown belong to the HTTPS www page. Use the Redirect Checker to see each hop on the way there, including the headers that triggered every redirect.

What does Cache-Control: no-cache mean?

It means a browser may keep a copy but must check with the server before using it, usually with an ETag or date comparison. It does not mean "never store". To stop storing entirely, servers use no-store. Both are common for pages that change often or contain private information.

Can HTTP headers slow a website down?

Headers themselves are tiny, but the rules they set affect speed. Good Cache-Control values let browsers reuse files instead of downloading them again, and compression shown in Content-Encoding reduces transfer size. Missing caching or compression headers are a common reason for slow repeat visits.