HTTP Header Checker

Check the HTTP headers of any URL exactly as the server sends them, in order and with every duplicate, with a security grade scored by Mozilla HTTP Observatory's own tests and the fix for nginx, Apache, IIS, Cloudflare, Vercel, Netlify or Express. Caching, cookies and server details too.

Updated October 24, 2026

One request from our server, the raw head kept in order · Mozilla HTTP Observatory's published tests (algorithm 6) · cookie values never shown or kept

We follow redirects to the final page and grade that page. Every hop's headers are under Redirects.

Try

What are HTTP headers?

HTTP headers are the lines a server sends before the page itself: a status line, then one name: value field per line, then an empty line and the body (RFC 9110). Names are case-insensitive; values are the server's own.

Response headers tell the browser what the content is, how long it may keep a copy, which cookies to store and which security rules to enforce. This checker shows them exactly as sent, in order and with every duplicate, and tints each line by what it does.

The anatomy of a responsegithub.com · recorded October 24, 2026

status lineHTTP/1.1200OK

field linesStrict-Transport-Security: max-age=31536000; includeSubdomains; preload

X-Frame-Options: deny

Cache-Control: max-age=0, private, must-revalidate

Content-Type: text/html; charset=utf-8

Set-Cookie: _gh_sess=‹344 characters›; path=/; HttpOnly; secure; SameSite=Lax

Server: github.com

… 14 more lines

body<!DOCTYPE html><html lang="en" …

Securitywhat the browser must enforce

Cachinghow long a copy may be reused

Cookieswhat the browser stores

Server & edgewho answered, through which CDN

How do I check a website's HTTP headers?

Type the URL above and select Check headers: the checker requests it from our server, follows any redirects to the final page and shows that page's response head line by line, with the security grade beside it. Choose HEAD in the method box to ask for the head alone.

Select any line to see what it does and what its value means. The views below sort the findings: Security with the fix per server, Caching, Cookies, Server & protocol and Redirects.

Header checker: the response exactly as sent

Original case and order, duplicates kept, read over HTTP/1.1; long values fold, cookie values never show. A site behind Cloudflare is read through Cloudflare's network, and the result says so.

Check security headers with Mozilla Observatory's tests

The same 12 tests and points as Observatory's code, both rounds worked out in the score column, and a link to Mozilla's own scan of the host.

Server header checker: software, CDN and protocol

Server and X-Powered-By with any version they give away, the CDN and its cache status, the TLS version, HTTP/2 and HTTP/3.

HSTS checker and preload readiness

max-age, includeSubDomains and preload read against hstspreload.org's rules, as information: preloading is optional.

HTTP header check of github.com: the response headers as sent and an A+ security grade of 115 — A header check of github.com: the grade and verdict, the response exactly as sent, and Mozilla HTTP Observatory's two rounds worked out. Select a number to see what each part shows.

Which security headers should every site send?

Start with four: Content-Security-Policy, Strict-Transport-Security, framing protection (X-Frame-Options or CSP frame-ancestors) and X-Content-Type-Options: nosniff. Missing them costs the most points in Mozilla HTTP Observatory's grade.

Referrer-Policy and the cross-origin policies (COOP, COEP and CORP) earn bonus points once the basics are right. Permissions-Policy is worth setting, but only Chromium browsers read it, and Observatory doesn't score it.

The security headers, and what each one is worthMozilla HTTP Observatory · algorithm 6

Header	Stops	Missing	Set well	Works in
Content-Security-Policy	injected scripts	−25	+5 / +10
Strict-Transport-Security	a downgrade to http://	−20	+5 preloaded
X-Frame-Options · frame-ancestors	clickjacking in a hidden frame	−20	+5
X-Content-Type-Options	files run as the wrong type	−5	0
Referrer-Policy	full URLs leaking to other sites	0	+5
Cross-Origin-Opener-Policy	other windows reaching in	0	+10
Cross-Origin-Embedder-Policy	loading what didn't opt in	0	+10
Cross-Origin-Resource-Policy	other sites embedding your files	0	+10
Permissions-Policy	embeds using camera, mic, location	—	not scored	only

Bonuses count only when the score is still 90 or more after penalties. Observatory's other tests look at cookies, subresource integrity, CORS and the redirect to HTTPS.

How is the security grade calculated?

We follow Mozilla HTTP Observatory's method test for test: start at 100, subtract every penalty, and only if the result is still 90 or more, add the bonuses. The score then maps to a grade from F to A+ (Observatory's scoring docs).

That second round surprises people: a site with one costly mistake keeps none of its bonuses. With COOP and COEP added in 2026, Observatory's code allows up to 165 points, while its docs still said 145 on October 24, 2026; we follow the code. Every result links to Mozilla's own scan of the host, so you can compare.

Two sites, worked outObservatory's own results, October 24, 2026

github.comA+

Start100
No SRI on external scripts−595
90 or more: the bonus round counts
Cookies: Secure, HttpOnly, SameSite+5
Referrer-Policy+5
HSTS preloaded+5
Framing via CSP+5
Score115

www.mozilla.orgB+

Start100
CSP allows 'unsafe-inline'−2080
under 90: the bonus round is skipped
COOP same-origin+10
Referrer-Policy+5
Framing via CSP+5
Score80

FD-DD+C-CC+B-BB+A-AA+

11580120without it

Mozilla's site loses 20 points to one CSP directive, and then the 20 bonus points it already earned don't count. With 'unsafe-inline' and 'unsafe-eval' gone from that script-src, the same headers would score 120.

What is HSTS, and should you preload it?

Strict-Transport-Security tells browsers to use only https:// for a host for max-age seconds, and includeSubDomains extends that to every subdomain (RFC 6797). Browsers ignore it over plain http://, and only the first such header counts. Observatory takes 20 points when it's missing and 10 when max-age is under six months.

Preloading is optional: hstspreload.org now says HSTS is recommended but preloading isn't, because Chrome and Safari already upgrade navigations to HTTPS, and leaving the list takes months. To submit anyway, you need a max-age of at least a year, includeSubDomains, preload and HTTPS on every subdomain; raise max-age in steps first.

Two domains against hstspreload.org's rulesrecorded October 24, 2026 · for information

github.comon the preload list

Valid certificate
http:// to https:// on the same host firsthttp://github.com → https://github.com/
www on HTTPS too
max-age of 31536000 or moremax-age=31536000
includeSubDomains
preload
HSTS on its https:// redirect too

mozilla.orgnot on the list

Valid certificate
http:// to https:// on the same host first302 → https://mozilla.org:443/
www on HTTPS too
max-age of 31536000 or moremax-age=60
includeSubDomains
preload · not sent
HSTS on its https:// redirect too

Raising max-age, as hstspreload.org suggests

3005 min · to test
6048007 days
259200030 days
31536000365 days · the preload minimum

Neither result is a fault: hstspreload.org says preloading is not recommended for most sites, and HSTS without it protects every visitor after their first visit.

What does a Content-Security-Policy do?

A Content-Security-Policy lists where a page may load scripts, styles, images and frames from, so a script an attacker injects from anywhere else doesn't run. Its frame-ancestors directive also says who may frame the page, and overrides X-Frame-Options (CSP Level 3).

'unsafe-inline' in script-src undoes most of that protection, which is why Observatory takes 20 points for it; use nonces or hashes instead (with one in the list, browsers ignore 'unsafe-inline'). A Content-Security-Policy-Report-Only header blocks nothing, it only reports, which makes it the safe way to try a new policy first.

A CSP, directive by directivegithub.com and www.mozilla.org · October 24, 2026

github.com

default-srcanything not listed below'none'

base-urithe page's <base href>'self'

script-srcwhere scripts may load fromgithub.githubassets.com 'sha256-6AKuI+cDd1MoUL1u4eqrA9PXmnPAkOB4h7421hPUUm0='

style-srcstylesheets'unsafe-inline' github.githubassets.com

img-srcimages'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com …

frame-ancestorswho may frame this page'none'

form-actionwhere forms may post'self' github.com gist.github.com copilot-workspace.githubnext.com …

script-src on www.mozilla.org'self' 'unsafe-eval' 'unsafe-inline' *.google-analytics.com *.googletagmanager.com google-analytics.com …

github.com starts from default-src 'none' and allows each source by name. With a nonce or a hash in the list, browsers ignore 'unsafe-inline'; Observatory then doesn't count it either.

Cache-Control explained: how long can a copy be reused?

For as many seconds as its max-age says: Cache-Control tells browsers and CDNs how long they may reuse a response without asking the server again, and s-maxage sets a separate lifetime for shared caches such as CDNs (RFC 9111).

no-cache doesn't mean "don't cache": it means store it, but check with the server before each reuse; no-store keeps it out of every cache. The Age header says how old a CDN's copy already is, and with no Cache-Control at all a browser may guess a lifetime of about 10% of the time since Last-Modified.

How long a copy stays freshwww.wikipedia.org · recorded October 24, 2026

Cache-Control: s-maxage=86400, must-revalidate, max-age=3600

Shared caches (CDN)s-maxage=86400 · 24 hr21 hr, 39 min left

Browsersmax-age=3600 · 1 hrstale

no-store	never write it to any cache
no-cache	store it, but ask the server before each reuse
max-age=N	fresh for N seconds (Expires is then ignored)
s-maxage=N	the same, for shared caches only
private	browsers only, never a CDN
immutable	don't revalidate on reload (Chrome ignores it)

The CDN copy was already 2 hr, 20 min old when it reached us, past the browsers' 1 hr: a browser that gets it must check with the server (an ETag request) before reusing it.

Secure sends a cookie only over HTTPS, HttpOnly hides it from scripts, and SameSite decides whether requests from other sites carry it: Strict never, Lax only on top-level links, None always, and then it must be Secure.

Session and login cookies need all three. Only Chrome and Edge treat a cookie without SameSite as Lax; Firefox and Safari still send it on cross-site requests, so set it yourself. The checker lists each cookie's name, length and flags: values are never shown or kept.

Cookie flags, cookie by cookiewww.youtube.com · 7 cookies · values never shown

Cookie	SameSite	Partitioned	Lifetime
__Secure-YNID	None		180 days
GPS	—	—	30 minutes
YSC	None		until the browser closes
__Secure-YEC	Lax	—	deletes it
VISITOR_INFO1_LIVE	None		180 days
VISITOR_PRIVACY_METADATA	None		180 days
__Secure-ROLLOUT_TOKEN	None		180 days

SameSite=None needs SecureBrowsers reject it otherwise; Partitioned needs Secure too.

The __Host- prefixSecure, Path=/ and no Domain, or the cookie is refused.

400 days at mostChrome trims a longer Expires or Max-Age (since version 104).

An Expires date in the past is how a server deletes a cookie: __Secure-YEC is cleared, not kept.

Which HTTP headers are deprecated?

X-XSS-Protection, Expect-CT, Public-Key-Pins, Feature-Policy and P3P no longer do anything useful in current browsers. X-XSS-Protection should be 0 or absent, because the old filter could itself open holes (OWASP).

Version numbers in Server and any X-Powered-By header aren't deprecated, but RFC 9110 and OWASP both advise against them: they tell attackers which known bugs to try (RFC 9110 §10.2.4).

Headers you can deleteOWASP · Chromium · RFC 9110

X-XSS-Protection: 1; mode=block

send 0, or nothing

Chrome 78 and Safari 15.4 removed their XSS filters; Firefox never had one. github.com and www.google.com send 0.

Chrome

Expect-CT

remove it

Deprecated since Chrome 107: Certificate Transparency is enforced anyway.

Chrome

Public-Key-Pins

remove it

Removed in Chrome 72; no current browser supports it.

Chrome

Feature-Policy

use Permissions-Policy

Renamed: the old header is deprecated.

Chrome

P3P

remove it

A dead privacy standard no current browser reads; www.youtube.com still sends one.

YouTube

Server: Apache/2.4.62 (Ubuntu)
X-Powered-By: PHP/8.3.12

drop the version

A made-up example: RFC 9110 and OWASP say this detail only helps attackers.

Apache

How do I see HTTP headers in Chrome or with curl?

In Chrome, open DevTools (F12), choose Network, reload, click the first row and open Headers. With curl, curl -sI https://example.com prints the response head; add --http1.1 to see the server's own spelling.

Over HTTP/2 and HTTP/3 every header name is lower-case by rule (RFC 9113 §8.2.1), so DevTools shows strict-transport-security where the server may have written Strict-Transport-Security. This checker reads over HTTP/1.1 and keeps the head exactly as sent.

See the headers yourselfcurl · Chrome DevTools

$ curl -sI --http1.1 https://github.com
HTTP/1.1 200 OK
Date: Sat, 24 Oct 2026 08:19:43 GMT
Content-Type: text/html; charset=utf-8
Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Reques…
content-language: en-US
ETag: W/"6995be88733b84f6fb0c35e84ad1df53"
Cache-Control: max-age=0, private, must-revalidate
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Frame-Options: deny
X-Content-Type-Options: nosniff
…

HeadersPreviewResponseTiming

DevTools › Network › the document row › Headers. Tick Raw to see the lines as received. Over HTTP/2 every name arrives lower-case; --http1.1 shows the server's own spelling.

HTTP header checker: frequently asked questions

What is a good security header grade?

A or A+ on Mozilla HTTP Observatory's scale: 90 points or more, so the bonus round counts. A site with no security headers at all usually lands around D or F; one that adds a CSP without unsafe sources, HSTS, framing protection and nosniff reaches 100, and Referrer-Policy, cookies and the cross-origin policies then lift it past 100 to A+.

Why is my grade different from securityheaders.com?

They measure different things. securityheaders.com grades mainly on which headers are present, by a points scheme its founder last described in 2023. We follow Mozilla HTTP Observatory's published tests, which also read the values, the cookies and the redirect to HTTPS, and count bonuses only at 90 or more. Each result links to Mozilla's own scan of the host so you can compare.

Can security headers break my site?

Yes, two of them can. A strict Content-Security-Policy can block scripts or styles the site needs, and HSTS with includeSubDomains breaks any subdomain that has no HTTPS. Roll a new CSP out as Content-Security-Policy-Report-Only first, read the reports, then enforce it; raise HSTS max-age in steps, starting with five minutes, before you commit to a year.

Can I check HTTP headers with a HEAD request?

Yes: choose HEAD in the method box beside the URL. The server should answer with the same headers it would send for GET, without the body, though some servers or CDNs answer HEAD differently, and the tests that read the HTML, such as subresource integrity, have no page to read. GET is the default because it shows exactly what a browser gets.

Is X-XSS-Protection still needed?

No. No current browser has the XSS filter it controlled: Chrome removed it in version 78, Safari in 15.4, and Firefox never had one. OWASP advises sending X-XSS-Protection: 0 or nothing, because the old filter could itself be abused, and Mozilla Observatory dropped its test in 2024. A Content-Security-Policy is what stops injected scripts today.

What does X-Content-Type-Options: nosniff do?

It tells the browser to trust the Content-Type the server sends instead of guessing from the content. With nosniff, a script or stylesheet served with the wrong type is blocked, so an uploaded file can't be run as JavaScript. It's the only valid value, and Observatory takes 5 points when the header is missing or invalid.

Why are header names lower-case in Chrome DevTools?

Because the page came over HTTP/2 or HTTP/3, where every header name must be lower-case (RFC 9113 §8.2.1). Header names are case-insensitive, so nothing is wrong. Over HTTP/1.1 the server's own spelling arrives, which is what this checker reads, so you may see Strict-Transport-Security here and strict-transport-security in DevTools for the same response.

How do I add security headers in nginx or Cloudflare?

In nginx, add an add_header line per header in the server block, with always so error pages get them too, then reload. On Cloudflare, use a Response Header Transform Rule, or a _headers file on Pages. Check the site here afterwards: each failing test in the Security view comes with a ready snippet for nginx, Apache, IIS, Cloudflare, Vercel, Netlify and Express.

What is the Server header, and should I hide it?

It names the software that answered, such as nginx or cloudflare. A bare product name is harmless, but RFC 9110 warns against fine-grained detail and OWASP recommends trimming it, because a version number like Apache/2.4.62 tells attackers which known bugs to try. Remove X-Powered-By entirely. The checker's server header view shows what both give away.

Does the header checker store the headers or cookies?

No. We fetch the URL from our server, show the result, and keep it for two minutes so a reload or a shared link answers fast; then it's gone. Cookie values are never shown or kept: the checker lists each cookie's name, the length of its value and its flags only. Nothing is tied to you, and the checked site never sees your address.

Missing something?Suggest a feature or a new tool

HTTP Header Checker

What are HTTP headers?

How do I check a website's HTTP headers?

Header checker: the response exactly as sent

Check security headers with Mozilla Observatory's tests