HTTP & Security Headers Checker — HSTS, CSP, X-Frame

What is HTTP & Security Headers?

This tool fetches a URL and shows exactly what the server sends back: the status code, the complete set of response headers, and the full chain of redirects if the URL bounces through one or more 30x responses before reaching its final destination.

It also grades the response against the security headers that matter most for hardening a site — HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy, Permissions-Policy and X-Content-Type-Options — so you can see at a glance what's configured and what's missing.

How to use the HTTP & Security Headers tool

1 Enter the full URL you want to inspect, including https://.
2 Choose GET to fetch the full response, or HEAD for a lighter check of headers only.
3 Run the check and follow the redirect chain, if any, to see every hop before the final response.
4 Review the security header score and add any headers flagged as missing to your server or CDN configuration.

When you need this tool

Debugging an unexpected redirect loop or extra hop added by a CDN, load balancer, or misconfigured rewrite rule.
Checking that caching headers (Cache-Control, ETag, Expires) are set the way you expect for CDN or browser caching.
Auditing a site's security header posture ahead of a penetration test or compliance review.
Confirming a CORS, CSP or cookie policy header was deployed correctly after a configuration change.
Verifying a web server or app reports the expected status code (and not a silent 404 or 500) for a key URL.

How it works

The tool makes an HTTP request to the URL using the method you choose, following each redirect response (301, 302, 307, 308, etc.) it receives and recording the status code, headers and target URL at every hop, until it reaches a final non-redirect response. It then checks the final response's headers against a known list of security-relevant headers to compute the score.

Frequently asked questions

Why does my site show multiple redirects for one URL?

It's common for a URL to pass through more than one redirect — for example http → https, then non-www → www (or the reverse), then a CDN-level rewrite — before reaching the final page. Each hop adds latency, so collapsing unnecessary redirects into a single step is a common performance win.

What is HSTS and why is it flagged as missing?

Strict-Transport-Security (HSTS) tells browsers to always use HTTPS for a domain, even if a user types or clicks an http:// link, preventing a downgrade attack on the very first request. It's flagged because it has to be deliberately added as a response header — it isn't on by default just because a site serves HTTPS.

Do I need every security header for a perfect score?

Not necessarily — some headers (like CSP) require careful configuration specific to your site's scripts and resources, and a badly configured CSP can break functionality. Treat the score as a checklist of what to evaluate deliberately, not a universal requirement to blindly enable everything.

Why does GET return different headers than HEAD?

They should return the same headers in a correctly implemented server, since HEAD is defined as a GET without a response body. If they differ, it usually means the server or an intermediate proxy/CDN handles the two methods inconsistently, which is worth investigating.