HTTP headers and security headers checker
Enter a URL to see every response header it sends, and which of the six main security headers it's missing.
Free, no signup
What it checks
- Every response header
- Exactly what the server sends, after following redirects.
- Six security headers
- HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
- What each one does
- A one-line explanation next to each missing header.
Questions and answers
Response headers that tell browsers to turn on protections, such as HTTPS only or blocking other sites from framing your pages. They're set in the web server or app configuration.
At least Strict-Transport-Security, X-Content-Type-Options, a frame policy (X-Frame-Options or CSP frame-ancestors) and a Referrer-Policy. A Content-Security-Policy takes more work but protects the most.
A CDN, proxy or redirect can add or remove headers. We show the headers of the final page after redirects, as browsers receive them.
Yes. UptimeGuardian checks your site every 5 minutes on the free plan and emails you when it fails.
Keep an eye on your site around the clock
Free for 10 monitors. No credit card required.
Start monitoring free