What is a Content Security Policy (CSP) header?

A Content Security Policy (CSP) tells browsers which resources (scripts, styles, images) are allowed to load on a page. A properly configured CSP significantly reduces the risk of XSS (cross-site scripting) attacks.

What is HSTS and why is it important?

HTTP Strict Transport Security (HSTS) instructs browsers to only connect to your site over HTTPS — even if the user types http://. It prevents protocol downgrade attacks and cookie hijacking over insecure connections.

What does X-Frame-Options do?

X-Frame-Options prevents your page from being embedded in an iframe on another domain, protecting against clickjacking attacks. The DENY or SAMEORIGIN values are the most common secure configurations.

What does X-Content-Type-Options: nosniff do?

This header prevents browsers from guessing the content type of a response. It forces the browser to respect the declared Content-Type, reducing the risk of MIME-type confusion attacks.

How do I add security headers to my website?

Security headers are set in your web server config (nginx, Apache), CDN settings (Cloudflare, AWS CloudFront), or application code. Example in nginx: add_header X-Frame-Options "SAMEORIGIN"; and add_header Strict-Transport-Security "max-age=31536000";

HTTP Headers Checker — Free Security & Response Headers Inspector

DevTool House

Loading…

HTTP headers checker

About HTTP Headers Checker

Fetch HTTP response headers for any URL and get a security header analysis — checking for HSTS, Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer Policy, and HTTPS status.

Last reviewed

June 23, 2026

Key Features

Fetches live HTTP response headers for any public URL
Security scoring based on presence of important headers
Checks HTTPS, HSTS, CSP, X-Frame-Options, and more
Displays all response headers in a readable format
Useful for security audits and deployment verification

How to Use HTTP Headers Checker

1Enter the URL you want to inspect.
2Send the request and review the returned response headers.
3Check the security score and note any missing security headers.
4Use the findings to harden your server's HTTP response configuration.

Pre-launch security checklist example

Before launching a web application, run the URL through the headers checker to confirm HTTPS is active, HSTS is set, Content Security Policy is present, and X-Frame-Options prevents clickjacking from unknown origins.

How It Works

The tool sends a request to the target URL through the DevTool House API service and returns the response status, headers, and a weighted security score based on the presence and configuration of key security headers.

Privacy Notes

The request is sent from the DevTool House API service, so the target server sees a request from this service rather than your IP. Do not check URLs that require authenticated sessions or private API endpoints.

Limitations

The tool checks publicly accessible URLs. It cannot inspect headers behind authentication, on internal networks, or from APIs that block external requests. Header values are reported but not deeply analysed for correctness of each policy directive.

Frequently Asked Questions

HTTP headers checker

About HTTP Headers Checker

Fetch HTTP response headers for any URL and get a security header analysis — checking for HSTS, Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer Policy, and HTTPS status.

Last reviewed

June 23, 2026

Key Features

Fetches live HTTP response headers for any public URL
Security scoring based on presence of important headers
Checks HTTPS, HSTS, CSP, X-Frame-Options, and more
Displays all response headers in a readable format
Useful for security audits and deployment verification

HTTP Headers Checker

About HTTP Headers Checker

Key Features

How to Use HTTP Headers Checker

Pre-launch security checklist example

How It Works

Privacy Notes

Limitations

Frequently Asked Questions

1What is a Content Security Policy (CSP) header?

2What is HSTS and why is it important?

3What does X-Frame-Options do?

4What does X-Content-Type-Options: nosniff do?

5How do I add security headers to my website?

HTTP Headers Checker

About HTTP Headers Checker

Key Features

How to Use HTTP Headers Checker

Pre-launch security checklist example

How It Works

Privacy Notes

Limitations

Frequently Asked Questions

1What is a Content Security Policy (CSP) header?

2What is HSTS and why is it important?

3What does X-Frame-Options do?

4What does X-Content-Type-Options: nosniff do?

5How do I add security headers to my website?