generatepassword.eu

HTTP Header Checker

See the response headers a web page returns and how its security headers are set up.

Try an example

Worth a look

Checked

200 OK · HTTP/1.1 · 104.20.23.154 · 33 ms

https://example.com/

Security headers

  • Consider

    HSTS not set

    Without HSTS, a visitor who types the domain without https:// can be intercepted before the redirect to HTTPS. Example: Strict-Transport-Security: max-age=31536000; includeSubDomains

  • Consider

    No Content Security Policy

    A CSP limits where scripts, styles and frames can load from and is a strong defence against cross-site scripting (XSS). It needs to be written for each site.

  • Consider

    Page can be framed by other sites

    Without X-Frame-Options or CSP frame-ancestors, other sites can embed the page, which enables clickjacking if it has sensitive actions.

  • Consider

    X-Content-Type-Options: nosniff not set

    A simple header that stops browsers from interpreting files as a different content type.

  • Info

    No Referrer-Policy

    Modern browsers default to strict-origin-when-cross-origin, which is reasonable. Set it explicitly to be sure.

  • Info

    No Permissions-Policy

    Optional. Useful to switch off browser features the site does not use.

All response headers

HeaderValue
DateThu, 24 Sep 2026 06:47:16 GMT
Content-Typetext/html
Transfer-Encodingchunked
Connectionkeep-alive
Servercloudflare
last-modifiedTue, 22 Sep 2026 20:16:57 GMT
allowGET, HEAD
Age9487
cf-cache-statusHIT
Content-Encodingbr
CF-RAYa3ffd6378b0e5629-IAD

About this tool

The checker sends one GET request to the URL (without following redirects), records the status line and headers, and stops before downloading the page body. It then reviews the headers that affect security.

How to read the results

Security headers are observations, not a grade. Whether a header is needed depends on the site: an API does not need a frame policy; a CSP has to be written for each site. Items are marked:

  • OK — set in a sensible way.
  • Consider — missing or weak; usually worth fixing on sites with logins or personal data.
  • Info — worth knowing, low risk.

Cookie values are hidden; only names and attributes are shown.

Limitations

  • Only ports 80 and 443 and public addresses are allowed. Redirects are not followed — use the redirect checker.
  • Servers may send different headers to browsers, to other countries or on different pages. One request shows one response.
  • The request identifies itself as this tool; sites behind bot protection may answer with a challenge page instead of the real headers.

Frequently asked questions

Which security headers matter most?

For most sites: Strict-Transport-Security (HTTPS only), X-Content-Type-Options: nosniff, a frame policy (CSP frame-ancestors or X-Frame-Options) and a Content-Security-Policy.

Is it bad to show the Server header?

Revealing software names is common and harmless on its own; revealing exact versions helps attackers find sites running outdated software. Hiding it is a small hardening step, not a fix.

Why does the checker show a 403 or a challenge?

Some sites block automated clients. The headers shown are what that site sends to such clients.

Do security headers affect SEO?

Not directly. They protect visitors; search engines do rank HTTPS sites, and HSTS helps make sure visitors always reach the HTTPS version.

What is HSTS?

A header telling browsers to always use HTTPS for your site.

What is a Content Security Policy?

A header listing which sources may load scripts and other content.

Are cookie values shown?

No, only cookie names and flags.