{jsonbody.com}

HTTP Headers Checker

Inspect HTTP response headers and see what each one does. Audit HSTS, CSP, X-Frame-Options and other security headers from pasted output or a URL. Free.

Inspect and audit HTTP response headers

Response headers control caching, security, cookies and much more, but they stay out of sight on a normal page view. Paste them here and you get a plain explanation of each header, along with a security audit that flags what is missing or weak. The checks cover Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy and cookie flags.

Get complete results with cURL

A web page cannot read every header from another site, because browsers reveal only what the server exposes through CORS. Check URL therefore often shows a partial list or fails outright. A missing header in that view does not prove the server lacks it. For a full picture, run this command in a terminal and paste the output into the box:

Fetch only the headers of a page
curl -sI https://example.com

HTTP/2 200
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
set-cookie: session=abc123; Path=/; HttpOnly

What the main security headers do

  • Strict-Transport-Security tells browsers to use HTTPS only. Aim for a max-age of at least six months.
  • Content-Security-Policy limits where scripts and other resources can load from, which is the strongest defence against XSS. Avoid 'unsafe-inline' in it where you can.
  • X-Content-Type-Options: nosniff stops browsers from guessing file types.
  • X-Frame-Options or the CSP frame-ancestors directive stops other sites from framing yours for clickjacking.
  • Referrer-Policy limits how much of your URLs leak to other sites.

Cookies and fixing problems

Session cookies should carry Secure, HttpOnly and SameSite. Without them, a cookie can be sent over plain HTTP, read by scripts or sent with cross-site requests. Most fixes are one line in your web server or framework config, for example add_header X-Content-Type-Options nosniff always; in nginx. Roll out a new Content-Security-Policy with Content-Security-Policy-Report-Only first, so you can catch breakage before it affects visitors. Also, avoid revealing software versions in Server or X-Powered-By, since they help attackers look for known flaws.

Frequently Asked Questions

Why does Check URL fail for most websites?

Browsers block a page from reading responses from other origins unless the server allows it via CORS. The cURL method has no such limit.

Why does the audit mark a header as missing when my site sends it?

If you used Check URL, the browser probably hid it. Paste the output from curl -sI to audit the complete list.

Do I need X-XSS-Protection?

No. Modern browsers have removed that filter. Use Content-Security-Policy instead.

What does -sI do in cURL?

-I sends a HEAD request so only headers come back, and -s hides the progress output. Some servers answer HEAD differently from GET, so compare with curl -si if something looks off.