HTTP Header Checker
Inspect all HTTP response headers for any URL. Security headers, redirect chain, cache policy, CORS settings, with missing-header warnings and severity ratings.
All Security Toolsallorigins.win) to fetch headers server-side. Results include the actual response headers returned by the target server.
What HTTP Headers Tell You
HTTP response headers are metadata sent by a server alongside every page response. They control security policy, caching behaviour, content type handling, and redirects. Misconfigured or missing security headers are one of the most common and easily fixed vulnerabilities on the web.
This tool checks eight critical security headers and rates their presence. It also shows the full raw header set, highlights the redirect chain, and gives a plain-English description of each missing header and why it matters.
Security score
Rated 0-100% based on which of the eight key security headers are present.
Missing header analysis
Each absent header is listed with a severity rating and explanation of the attack it leaves open.
Full header dump
Every response header shown in a clean name/value table — sortable, readable, monospace.
Redirect detection
Shows the Location header if a redirect is detected, useful for diagnosing redirect chains.
Security headers reference
| Header | Severity if missing | What it protects against |
|---|---|---|
| Strict-Transport-Security | HIGH | HTTPS downgrade attacks and protocol-level MITM |
| Content-Security-Policy | HIGH | Cross-site scripting (XSS) and data injection |
| X-Frame-Options | HIGH | Clickjacking via malicious iframes |
| X-Content-Type-Options | MEDIUM | MIME sniffing attacks that execute uploaded files as scripts |
| Referrer-Policy | MEDIUM | Leaking sensitive URL parameters to third-party sites |
| Permissions-Policy | MEDIUM | Unauthorised access to camera, mic, geolocation via scripts |
| Cross-Origin-Opener-Policy | LOW | Cross-origin window access and Spectre-style timing attacks |
| Cross-Origin-Embedder-Policy | LOW | Required for SharedArrayBuffer; complements COOP isolation |
Common Questions
Questions About the HTTP Header Checker
HTTP security headers are directives added to server responses that tell browsers how to behave when handling your site’s content. They control things like whether the page can be embedded in an iframe, which scripts are allowed to run, whether to enforce HTTPS, and how referrer information is shared. Setting them correctly closes common attack vectors without changing any application code.
Headers are set at the web server or CDN layer, not in your application code. On Nginx add them in your server block using add_header directives. On Apache use Header set in .htaccess or your virtual host config. Cloudflare and most CDNs let you add response headers in their dashboard without touching the server. WordPress users can add headers via plugins like HTTP Headers or Security Headers.
Missing security headers leave users exposed to attacks like clickjacking, XSS, and protocol downgrades. These are not theoretical — they are exploited actively. The OWASP Top 10 consistently lists security misconfiguration as one of the most critical web vulnerabilities. A low score means low-hanging fixes are available that will improve your security posture significantly.
HTTP Strict Transport Security (HSTS) tells browsers to always connect to your site over HTTPS, even if the user types http:// or clicks an http:// link. Without it, an attacker on the same network can intercept the initial plain HTTP connection and redirect the user to a fake site before HTTPS kicks in. It is one of the simplest and most impactful security headers to add.
Browsers enforce the Same-Origin Policy, which blocks JavaScript from reading response headers from other domains. A proxy fetches the URL server-side and returns the headers as data your browser can read. The proxy does not store your requests. For sensitive internal URLs, use a local tool like curl instead.