HTTP Header Checker
Inspect all HTTP response headers for any URL. Security headers, redirect chain, cache policy, CORS settings, with missing-header warnings and severity ratings.
All Security ToolsEnter a URL to grade its security headers and see exactly what each one is doing.
What the grade means. Each header is weighted by how much real protection it provides. Content-Security-Policy carries the most weight because it is the strongest defence against cross-site scripting. Deprecated headers like X-XSS-Protection carry almost none, and we mark them as passing when they are absent, because that is the correct modern configuration.
Presence is not the same as protection. A Content-Security-Policy containing unsafe-inline will happily pass a checker that only looks for the header name, while providing close to no protection at all. This tool parses the policy and tells you when that is the case.
Headers that reveal your stack are flagged rather than scored. Knowing your exact server and framework version does not let an attacker in by itself, but it does tell them which published vulnerabilities to try first.
How this checker reads another site’s headers despite the browser’s own CORS rules
Here is the constraint this tool has to work around. Browsers enforce the Same-Origin Policy, which means a page on convertnow.tools cannot directly fetch response headers from an arbitrary third party domain and read them in JavaScript, the browser blocks that by design to stop sites from snooping on each other. So this tool does not talk to the target site directly. It routes the request through api.allorigins.win, a public CORS proxy, which fetches the target URL server-side and hands the response, including headers and status code, back as JSON that JavaScript is allowed to read.
Be plain about what that means. The URL you enter is sent to AllOrigins, a third party service not operated by convertnow.tools, which then makes the real request to the target site on your behalf. Your browser never talks to the target server directly for this check. If you need to verify headers for something sensitive or internal, keep in mind the URL passes through that proxy.
What happens when you click Check Headers
https:// prepended automatically. performance.now() brackets the fetch so the tool can report round-trip time in milliseconds, though that figure includes the proxy hop, not just the target server’s own response time.
https://api.allorigins.win/get?url= with your target URL URL-encoded as a query parameter, using cache: 'no-store' to avoid a stale cached response.
data.status.http_code for the status and data.status.headers for the raw header object, then lowercases every header name so lookups are case-insensitive regardless of how the origin server capitalised them.
The eight headers on the checklist
| Header | Severity | What it does |
|---|---|---|
| Strict-Transport-Security | High | Forces HTTPS on future visits, blocking protocol downgrade attacks |
| Content-Security-Policy | High | Restricts which sources can load scripts, styles and frames, the main XSS mitigation |
| X-Frame-Options | High | Controls whether the page can be embedded in an iframe, preventing clickjacking |
| X-Content-Type-Options | Medium | Set to nosniff, stops the browser guessing content types in a way scripts can exploit |
| Referrer-Policy | Medium | Controls how much of the referring URL is leaked to the next site |
| Permissions-Policy | Medium | Restricts access to camera, microphone, geolocation and other browser features |
| Cross-Origin-Opener-Policy | Low | Isolates the browsing context from cross-origin windows |
| Cross-Origin-Embedder-Policy | Low | Required alongside COOP for SharedArrayBuffer and Spectre-class mitigations |
curl -I from your own terminal.Two other things the results panel shows
Redirect detection
If the response includes a Location header, the tool renders a two-step chain showing the requested URL and where it redirects to. It shows one hop only, since the proxy itself resolves the request and does not expose the full chain if there were multiple redirects along the way.
Full raw header dump
Beyond the eight-item security checklist, every header the proxy captured is listed alphabetically in the All Headers tab, useful for spotting things like a Server header leaking version info or an unexpected Set-Cookie without the Secure flag.
- OWASP Secure Headers Project is the closest thing to an authoritative reference for what each of these headers should be set to.
- RFC 6797 defines HTTP Strict Transport Security.
- W3C Content Security Policy Level 3 is the current CSP specification.
- MDN HTTP headers reference covers every header this tool checks in more depth, including browser support notes.
Headers worth auditing
Checking your own site’s header configuration after deploying a new CDN or reverse proxy, verifying a CSP header actually shipped to production and was not left in a staging only config, auditing a vendor or partner’s site before a security review, and spotting a missing HSTS header before a penetration test flags it for you.
Common Questions
Questions About the HTTP Header Checker
HTTP security headers are directives added to server responses that tell browsers how to behave when handling your site’s content. They control things like whether the page can be embedded in an iframe, which scripts are allowed to run, whether to enforce HTTPS, and how referrer information is shared. Setting them correctly closes common attack vectors without changing any application code.
Headers are set at the web server or CDN layer, not in your application code. On Nginx add them in your server block using add_header directives. On Apache use Header set in .htaccess or your virtual host config. Cloudflare and most CDNs let you add response headers in their dashboard without touching the server. WordPress users can add headers via plugins like HTTP Headers or Security Headers.
Missing security headers leave users exposed to attacks like clickjacking, XSS, and protocol downgrades. These are not theoretical — they are exploited actively. The OWASP Top 10 consistently lists security misconfiguration as one of the most critical web vulnerabilities. A low score means low-hanging fixes are available that will improve your security posture significantly.
HTTP Strict Transport Security (HSTS) tells browsers to always connect to your site over HTTPS, even if the user types http:// or clicks an http:// link. Without it, an attacker on the same network can intercept the initial plain HTTP connection and redirect the user to a fake site before HTTPS kicks in. It is one of the simplest and most impactful security headers to add.
Browsers enforce the Same-Origin Policy, which blocks JavaScript from reading response headers from other domains. A proxy fetches the URL server-side and returns the headers as data your browser can read. The proxy does not store your requests. For sensitive internal URLs, use a local tool like curl instead.
From the blog
Security writing without the scare tactics
Practical explanations of hashing, headers, certificates and consent, aimed at people who have to ship something this week.
