HTTP headers and security checker
See exactly what the server returns: status code, HTTP version, response time and the six security headers every website should send.
Server response
All response headers
Unlock the full report
Leave your email or WhatsApp — the full breakdown opens right away, and a specialist can send you a short comment on the priorities.
The six security headers
- Strict-Transport-Security — forces the browser to always use HTTPS.
- Content-Security-Policy — restricts where scripts and styles can be loaded from.
- X-Frame-Options — prevents the site from being embedded in third-party iframes.
- X-Content-Type-Options — stops the browser from “guessing” the file type.
- Referrer-Policy — controls how much URL information is passed on to other sites.
- Permissions-Policy — turns off features such as camera and geolocation when they are not used.
What about SEO?
Headers also carry instructions for search engines: X-Robots-Tag can hide pages from
Google without anyone noticing it in the HTML, and Cache-Control affects speed.
It is worth reviewing the full list after any server or CDN change.
One check is a start. A full picture is better.
Run the free 60-second audit — 30 checks across on-page, technical and performance.