HTTP Header Checker: Security, Cache and Indexing

How to use

1. Run curl -I on your address, or copy the response headers from your browser's network panel.
2. Paste them into the box.
3. Read the findings, grouped as security, cache, cookies and indexing.
4. Fix the headers on your server or CDN, then paste a new response to confirm.

What it checks and how it works

The tool reads the headers you paste and requests nothing. Security headers are checked against the OWASP HTTP Security Response Headers Cheat Sheet, for example X-Content-Type-Options, Referrer-Policy, Strict-Transport-Security, Content-Security-Policy, Permissions-Policy and headers that reveal the server. Content-Security-Policy is read for 'unsafe-inline' and 'unsafe-eval', which MDN advises avoiding. Strict-Transport-Security is read for its max-age; hstspreload.org lists the requirements for preloading, a max-age of at least 31536000 and includeSubDomains, and the tool reports them as information and does not tell you to preload. Cache-Control is read against MDN: max-age, s-maxage, no-cache, no-store, private, public and immutable. Set-Cookie is checked for Secure, HttpOnly and SameSite, and SameSite=None without Secure is flagged, as MDN describes. X-Robots-Tag is parsed with the rules in Google Search Central's robots meta tag and X-Robots-Tag specification, including an optional user-agent prefix and unavailable_after dates.

Limits: the tool reads the text you paste, so it cannot tell whether a header is right for your site, and a header that is missing here may be added by another layer such as a CDN or a different path. A missing header is a prompt to review and not proof of a flaw.