Inspect the HTTP response headers for any URL. Audit the security headers that protect your site and confirm the configuration that search engines read.
HTTP response headers are the first thing a browser or crawler receives from your server. They carry information about security, caching, and SEO that is not visible on the page itself. A missing security header is an open door for attacks such as clickjacking, MIME sniffing, and cross site scripting. A strict Content Security Policy and HTTP Strict Transport Security header reduce those risks in a measurable way.
Search engines factor page speed and security into ranking signals. Cache headers such as the Cache Control header and ETag help browsers reuse content, which speeds up repeat visits. SEO headers such as the robots header and the Link header (canonical, hreflang) tell crawlers how to treat a page. When these headers are wrong or missing, crawlers may waste resources or misread your intent.
This tool gives you a complete view of every header your server returns, grouped by purpose, with a grade for the security headers that matter most. Use it to confirm that changes you make in your server configuration actually reach the browser. A header check after a deploy can catch a misplaced directive before it affects real users or search visibility.
Enter the full URL of the page you want to inspect, including the protocol. Click "Check Headers" and wait a moment while the tool fetches the response. The results show the HTTP status, the final URL after any redirects, and a security grade based on five core headers.
The five headers that drive the security grade are Content Security Policy, Strict Transport Security, X Frame Options, X Content Type Options, and Referrer Policy. Each one earns a point when present. The grade is the percentage of those five headers found. The Security Headers section lists all five, marks each present or missing, and explains what it controls.
Expand "Raw Response Headers" to see the exact text your server returns. Use the copy button to save it for a report or a ticket. Run this check after any server or CDN change, and compare results over time to confirm your security posture stays consistent as your site grows.