HTTP Headers Checker

HTTP headers are key-value pairs sent between the browser and server with every request and response. Response headers tell the browser how to handle the content — what type it is, how long to cache it, what security rules apply, and more.

Content-Security-Policy (CSP) is a security header that tells the browser which sources of content are trusted. It helps prevent cross-site scripting (XSS) attacks by blocking scripts, styles, or images from untrusted origins. A missing CSP header is a common security finding.

HTTP Strict Transport Security (HSTS) is a header that tells browsers to only connect to a site over HTTPS, never HTTP. It prevents protocol downgrade attacks. The header looks like: Strict-Transport-Security: max-age=31536000; includeSubDomains.

Cache-Control tells browsers and CDNs how long to cache a response. Common values: no-store (never cache), no-cache (revalidate before using cache), max-age=3600 (cache for 1 hour), public (any cache can store it), private (only browser cache).

X-Frame-Options controls whether a page can be embedded in an iframe on another site. DENY blocks all framing. SAMEORIGIN allows framing only from the same domain. It prevents clickjacking attacks where an attacker overlays a transparent iframe over their malicious page.