Make a constrained request
The URL is validated as public and redirect destinations are checked again.
Direct answer: An HTTP headers check records the response status, caching directives and browser-policy headers returned without executing page scripts or evaluating the rendered application.
The server makes one bounded request to the public URL and reads selected response headers without executing its scripts. Result responses are private, uncached and excluded from search indexing. Do not enter passwords or secrets. Read the lookup privacy policy.
What this http headers check tells you
This check retrieves response headers without executing page scripts. It helps you inspect redirects, caching, content metadata and common browser policy headers while recognizing that header presence is not the same as effective security.
- Which headers the endpoint returned to this request
- Whether common transport, framing and content policy signals are present
- Which finding requires browser or application-level verification
Interpret this response alongside the website monitoring methodology because a header-only observation cannot establish application health.
Pair the header snapshot with a one-time website availability check when status, redirect timing and reachability are also part of the question.
How the evidence is collected
Preserve raw names and values
The report avoids converting a present header into a pass unless its directive has been interpreted.
Review in context
Caching, CSP and CORS behavior depends on request method, origin, resource type and intermediary caches.
Read the fields without overclaiming
| Signal | What it can establish | What it does not prove |
|---|---|---|
| Content-Type | The media type the server declares for the response. | That sniffing or rendering is safe in every context. |
| Cache-Control | Caching directives for recipients and shared caches. | Proof every intermediary behaved as intended. |
| HSTS | A browser instruction to prefer HTTPS for a period after secure receipt. | Protection on the first-ever insecure visit. |
| CSP | A set of browser content-loading restrictions. | A complete fix for injection vulnerabilities. |
CSP exists but allows unsafe-inline
Record the policy as present but permissive for inline script or style in the affected directive. Review the full directive set, report-only versus enforcing mode, nonces or hashes, and actual browser violations before recommending a change.
Common mistakes
- Awarding a pass for header presence alone
- Reading CORS without the request Origin
- Ignoring redirects that set different policy
- Assuming Server header removal fixes application weaknesses
HTTP Headers Check FAQ
Should every site use the same headers?
No. Appropriate policy depends on application behavior, embedding, subdomains and third-party resources.
What is report-only CSP?
It asks browsers to report policy violations without enforcing them, which is useful for deployment testing but does not block the behavior.
Can this tool test cookies?
It can display Set-Cookie values returned to this request, but a full review also needs path, domain, browser context and authenticated flows.
Explore more http headers check and domain research questions