HTTP Headers Analyzer
Inspect response headers and security configurations
Response Summary
WaitingResponse Headers
| Header Name | Header Value |
|---|---|
| No headers yet | |
Security Headers Analysis
0 checks performedRun an analysis to see security recommendations.
Raw Headers
Learn more & FAQ
What does an HTTP headers analyzer do?
Every HTTP response carries headers that tell the browser how to treat the page - what to cache, what scripts to trust, whether to enforce HTTPS, and more. This tool requests a URL, captures every response header it sends back, and runs them against the headers security scanners and browsers actually check for.
How to read your results
Response Summary shows the status code, server, and protocol for the request. Response Headers lists every header exactly as sent. Security Headers Analysis checks for the specific headers that harden a site against common attacks and scores the response - each missing or weak header is flagged individually with what it protects against, so you know exactly what to add and why.
Frequently asked questions
What are HTTP security headers?
Security headers are response headers a server sends to tell browsers how to handle its content safely - things like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options. They restrict what a page is allowed to do, reducing the impact of certain attacks even if other defenses fail.
Why is my security score lower than I expected?
Most sites start without several recommended headers set at all, since they aren't required for a site to function - they're an extra layer of defense. The analysis lists exactly which headers are missing or misconfigured so you can address them one at a time.
What does the Strict-Transport-Security header do?
HSTS tells browsers to only ever connect to your domain over HTTPS, for a period of time you specify, even if a user types or clicks an http:// link. It protects against downgrade attacks that try to trick a browser into using an unencrypted connection.
Is it safe to add security headers to a live site right away?
Most are safe to add immediately, but Content-Security-Policy in particular can break page functionality if it's too restrictive for your site's actual scripts and styles - it's commonly rolled out in a report-only mode first so you can see what it would block before enforcing it.
Do these headers affect page speed or SEO directly?
Security headers don't directly affect ranking or load time - they're read instantly by the browser with no extra round trip. Caching headers shown alongside them, however, do affect repeat-visit load speed, which is itself a factor search engines consider.