generatepassword.eu

HTTP Header Checker

See the response headers a web page returns and how its security headers are set up.

Try an example

Looks good

Checked

200 OK · HTTP/1.1 · 140.82.114.3 · 11 ms

https://github.com/

Security headers

  • OK

    HSTS enabled for 1 year, including subdomains

    Browsers will only use HTTPS for this host for that period.

  • OK

    Content Security Policy is enforced

    Review the directives to make sure they match what the site actually loads.

  • OK

    Framing restricted by CSP frame-ancestors

    Policy: frame-ancestors 'none'

  • OK

    MIME sniffing disabled (nosniff)

    Browsers will not guess content types, which blocks some script-injection tricks.

  • OK

    Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin

    Controls how much of the page address is shared with other sites.

  • Info

    No Permissions-Policy

    Optional. Useful to switch off browser features the site does not use.

  • OK

    Cookie "_gh_sess" has Secure, HttpOnly and SameSite

    Cookie values are not shown.

  • Info

    Cookie "_octo" is missing: HttpOnly

    HttpOnly is only needed for cookies JavaScript does not read; Secure should be set on HTTPS sites; SameSite limits cross-site sending. Cookie values are not shown.

  • OK

    Cookie "logged_in" has Secure, HttpOnly and SameSite

    Cookie values are not shown.

All response headers

HeaderValue
DateThu, 24 Sep 2026 07:42:52 GMT
Content-Typetext/html; charset=utf-8
content-languageen-US
VaryX-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, X-GitHub-Client-Version, Accept-Language, Sec-Fetch-Site,Accept-Encoding, Accept, X-Requested-With
ETagW/"caf101636ff9de60cc179aebdf2e17b5"
Cache-Controlmax-age=0, private, must-revalidate
Strict-Transport-Securitymax-age=31536000; includeSubdomains; preload
X-Frame-Optionsdeny
X-Content-Type-Optionsnosniff
X-XSS-Protection0
Referrer-Policyorigin-when-cross-origin, strict-origin-when-cross-origin
Content-Security-Policydefault-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com api.github.com/cmc_internal/api/ edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com *.googleusercontent.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com 'sha256-tSjmyPUky1KbRZ0fw9VUil3wFEbeM82rtbJDygGJAXw='; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
Servergithub.com
Content-Encodinggzip
Accept-Rangesbytes
Set-Cookie_gh_sess=[value hidden]; path=/; HttpOnly; secure; SameSite=Lax
Set-Cookie_octo=[value hidden]; expires=Fri, 24 Sep 2027 07:42:54 GMT; domain=.github.com; path=/; secure; SameSite=Lax
Set-Cookielogged_in=[value hidden]; expires=Fri, 24 Sep 2027 07:42:54 GMT; domain=.github.com; path=/; HttpOnly; secure; SameSite=Lax
X-GitHub-Request-IdCA88:1ED3EE:879428:B8B1C2:6AB4D47E
x-github-edge-regioniad
Transfer-Encodingchunked

About this tool

The checker sends one GET request to the URL (without following redirects), records the status line and headers, and stops before downloading the page body. It then reviews the headers that affect security.

How to read the results

Security headers are observations, not a grade. Whether a header is needed depends on the site: an API does not need a frame policy; a CSP has to be written for each site. Items are marked:

  • OK — set in a sensible way.
  • Consider — missing or weak; usually worth fixing on sites with logins or personal data.
  • Info — worth knowing, low risk.

Cookie values are hidden; only names and attributes are shown.

Limitations

  • Only ports 80 and 443 and public addresses are allowed. Redirects are not followed — use the redirect checker.
  • Servers may send different headers to browsers, to other countries or on different pages. One request shows one response.
  • The request identifies itself as this tool; sites behind bot protection may answer with a challenge page instead of the real headers.

Frequently asked questions

Which security headers matter most?

For most sites: Strict-Transport-Security (HTTPS only), X-Content-Type-Options: nosniff, a frame policy (CSP frame-ancestors or X-Frame-Options) and a Content-Security-Policy.

Is it bad to show the Server header?

Revealing software names is common and harmless on its own; revealing exact versions helps attackers find sites running outdated software. Hiding it is a small hardening step, not a fix.

Why does the checker show a 403 or a challenge?

Some sites block automated clients. The headers shown are what that site sends to such clients.

Do security headers affect SEO?

Not directly. They protect visitors; search engines do rank HTTPS sites, and HSTS helps make sure visitors always reach the HTTPS version.

What is HSTS?

A header telling browsers to always use HTTPS for your site.

What is a Content Security Policy?

A header listing which sources may load scripts and other content.

Are cookie values shown?

No, only cookie names and flags.