What are HTTP headers?
Every time a browser asks for a page, the server answers with a status code and a set of headers before the page itself. Headers say what kind of content follows, whether it is compressed, how long it may be cached, and which security rules the browser must apply. They are invisible on the page, which is why a checker like this is useful.
The security headers graded
- Strict-Transport-Security (HSTS): tells browsers to use https only.
- Content-Security-Policy: lists where scripts and other content may load from — the strongest defence against cross-site scripting.
- X-Content-Type-Options: nosniff: stops browsers guessing file types.
- X-Frame-Options or CSP frame-ancestors: stops other sites showing your pages inside a frame to trick visitors.
- Referrer-Policy and Permissions-Policy: limit what is shared with other sites and which browser features pages may use.
How to add the missing ones
On Apache or LiteSpeed hosting, add them in your .htaccess file — the .htaccess Generator on this site writes the lines for you. On Nginx, use add_header in the server block; on Cloudflare, use Transform Rules.
Frequently asked questions
How do I see the headers of a website?
Enter its address above. You can also open your browser’s developer tools, go to the Network tab, reload, and click the first request.
Why does the checker not follow redirects?
So that you see the headers of the exact address you entered. Use the Redirect Checker to see each step of a redirect chain.
Does a missing header mean my site is hacked?
No. It means one layer of protection is not switched on. Adding the headers makes some kinds of attacks harder.