NETWORK TOOL

HTTP Header Lookup

Analyze HTTP response headers for any public website or domain and audit their security configurations.

🔍

URL Header Inspector

Enter any public URL above to query and audit its HTTP response headers directly from our edge nodes.

RESPONSE SUMMARY

STATUS CODE

—

RESOLVED URL

—

LATENCY

—

HEADERS TOTAL

—

SECURITY HEADERS AUDIT

Rating: —

—

Security Score — / 100

Enter a URL above to run the security headers audit.

HTTP RESPONSE HEADERS

Header Name	Value

HTTP HEADERS EXPLAINED

HTTP headers are name-value pairs sent between a client (your browser) and a server. They pass extra metadata alongside requests or responses:

Request Headers: Sent by your browser to describe yourself, declare language preferences, set connection states, or pass authentication.
Response Headers: Sent back by the web server to tell the browser how to cache files, serve content types, or enforce security.

SECURITY CHECKLIST

Content-Security-Policy (CSP)

Restricts resource loading origins to prevent cross-site scripting (XSS) and code injection.

Strict-Transport-Security (HSTS)

Forces browsers to connect solely via secure HTTPS tunnels, blocking man-in-the-middle exploits.

X-Frame-Options

Informs browsers whether the page can load inside an iframe. Blocks clickjacking attacks.

X-Content-Type-Options

Disables browser MIME-type sniffing, preventing executable scripts from masquerading as text/images.

Referrer-Policy

Sets security levels for referrer header data sent when moving to external websites.

Why HTTP Headers Matter for Web Security

Every communication on the World Wide Web consists of request and response pairs. When your browser requests a web page, it sends Request Headers detailing the formats it supports, its identity (User-Agent), and its cookies. The remote server responds with Response Headers, which convey caching, contents, and security guidelines.

Response headers are the primary mechanism through which web servers instruct modern browsers to enforce security behaviors. Missing or misconfigured security headers account for a large percentage of web application vulnerabilities, exposing sites to cross-site scripting (XSS), clickjacking, and mime-type sniffing attacks.

Understanding the Core Security Headers

Security headers like Content Security Policy (CSP) and HSTS (HTTP Strict Transport Security) act as server-side guardrails. HSTS guarantees that the browser will refuse to load the website over insecure HTTP, eliminating SSL-stripping vectors. CSP limits the assets (scripts, fonts, images) the browser can run to pre-approved locations, mitigating script injection attacks.

Our analyzer evaluates these headers against production security benchmarks and scores websites from A+ to F based on their defense-in-depth posture.

Frequently Asked Questions

What are HTTP Response Headers?

HTTP response headers are metadata key-value pairs sent by a web server to the client browser in response to a request. They define caching rules, connection properties, content encoding formats, and security policies.

Which HTTP security headers does this tool audit?

This tool audits the presence and values of core security headers: Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

What is HTTP Strict Transport Security (HSTS)?

HTTP Strict Transport Security (HSTS) is a header that forces browsers to interact with the website using secure HTTPS connections only, preventing man-in-the-middle attacks that downgrade requests to plaintext HTTP.

Why is Content Security Policy (CSP) critical?

Content Security Policy (CSP) is a security header that helps webmasters detect and mitigate cross-site scripting (XSS) and data injection attacks by restricting the origins from which scripts, stylesheets, and media can be loaded.