Free tool · Network & server
HTTP headers and security headers checker
See every HTTP response header a page returns, with a grade and recommended value for each security header, caching headers, compression savings and cookie attributes.
HTTP Headers Checker
What it checks
What the server says before the page loads
Response headers control how browsers treat a page: whether to insist on HTTPS, which scripts may run, whether the page can be framed by another site, how long to cache it, and how cookies are protected. The checker requests the page, follows redirects, and lists the headers of the final response with an assessment.
Security headers
Strict-Transport-Security (including max-age), Content-Security-Policy (and whether it still allows unsafe inline scripts), clickjacking protection through X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, each rated Good, Weak or Missing with a recommended value.
Information disclosure
Server headers with version numbers, X-Powered-By and ASP.NET version headers that advertise software and versions to anyone.
Caching
Cache-Control, Expires, ETag, Last-Modified, Age, Vary and CDN cache status headers such as CF-Cache-Status and X-Cache.
Compression
The Content-Encoding in use (Brotli, gzip or none) and how many kilobytes were transferred compared with the uncompressed size.
Cookies
Every cookie set by the response with its Secure, HttpOnly and SameSite attributes, and warnings for session-like cookies without protection.
All headers
The complete list of response headers and the HTTP version negotiated, for debugging CDNs, proxies and application frameworks.
Why it matters
Cheap protection, easy to forget
Security headers are some of the least expensive protections a site can have: a few lines of server configuration that make cross-site scripting, clickjacking and protocol downgrade attacks harder. They are also easy to lose during a migration to a new server, CDN or hosting panel, which is why they are worth checking after every infrastructure change.
Caching and compression headers decide how fast repeat visits are and how much bandwidth each page costs. A missing Content-Encoding can make HTML, CSS and JavaScript three to five times larger in transfer than necessary.
Introduce CSP carefully
A strict Content-Security-Policy can block scripts the site depends on, such as analytics, chat widgets and payment forms. Start with Content-Security-Policy-Report-Only, collect the reports, adjust the policy, then enforce it.
Questions
About HTTP headers
HSTS only helps if the certificate is valid everywhere you include. Check it with the SSL Certificate Checker.
Where do I set these headers?
In the web server (Apache .htaccess or virtual host, nginx server block), at the CDN (Cloudflare Transform Rules, Fastly VCL), or in the application framework. Set each header in one place to avoid duplicates with conflicting values.
Is X-XSS-Protection still needed?
No. Modern browsers removed the XSS auditor that header controlled. A Content-Security-Policy is the current protection.
Should I enable HSTS preload?
Only when every subdomain works over HTTPS and will keep doing so. Preloading is hard to undo because browsers ship the list with their releases.
Why do the headers differ from what my browser shows?
CDNs and servers can vary responses by country, device, cookies or bot detection. This check shows what HUB’s server received without cookies.
This tool came from ToolsPing?
Yes. It combines ToolsPing’s HTTP headers and gzip compression tools, rebuilt for HUB with security header grading and cookie checks.
Need help with what
the tools found?
HUB engineers implement technical SEO, performance, security and AI-readiness fixes on WordPress, Magento, custom PHP and modern JavaScript stacks.