HTTP Headers Checker

HTTP headers checker: what the report shows

The tool sends a normal GET request (not HEAD) to the URL, follows up to 10 redirects and shows the headers of the final response. The redirect chain itself is not listed; to see each hop and its status code, use the redirect checker.

The report has four parts: an overview (HTTP status, response time, HTTPS or HTTP, header count and the Server value), "Security Headers", the full "All Response Headers" table and "Caching & Performance".

Requests go out with the user agent PromoPilot SEO Tools. If the site sits behind a WAF or bot protection, you may see a 403 or 503 and the headers of a challenge page rather than the real response. When that happens, compare with the curl commands below.

How the security score is calculated

Only the presence of a header is scored, not its value. Strict-Transport-Security: max-age=0 or a CSP full of 'unsafe-inline' earns full points while protecting very little. A policy sent as Content-Security-Policy-Report-Only earns nothing, because the checker looks for the exact header name. So read the values — each one is printed under the header it belongs to.

Recommended security header values

nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

The nginx trap: if a location block has even one add_header of its own, it inherits none from the server level. The usual symptom is headers on the home page that vanish on static files or one section of the site — so test several URLs, not just the root.

Apache and .htaccess

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

WordPress, Shopify and hosted builders

On WordPress, set headers in .htaccess or the server config. From theme code, the send_headers hook with header() works, but only for responses PHP generates — images and static files will not get them. On hosted platforms such as Shopify, Wix or Squarespace you cannot edit server config; custom headers are only possible through a proxy in front of the site, for example Cloudflare's response header transform rules.

Common problems the report reveals

• The same header twice. Two X-Frame-Options or two Cache-Control rows with different values mean both the CMS and the server (or the server and the CDN) are adding them. Browsers then behave unpredictably — keep one source.
• Software versions on display. Server: nginx/1.18.0 or X-Powered-By: PHP/7.4 tells an attacker which vulnerabilities to try. Hide them with server_tokens off; in nginx and expose_php = Off in PHP.
• HSTS on a plain HTTP response. Browsers accept Strict-Transport-Security only over HTTPS; on an HTTP response it does nothing.
• Headers missing on errors. Without always, nginx does not add headers to 4xx and 5xx responses. While you are at it, test a URL that does not exist: it should return 404, not 200.
• CDN cache status. Headers such as cf-cache-status, X-Cache and Age tell you whether the page came from the CDN cache or from your origin.

For a letter grade from A to F on the same set of security headers, use the separate security headers check.

Caching and compression headers

The "Caching & Performance" block shows whether Cache-Control, ETag, Last-Modified, Content-Encoding, Vary and Content-Type are present. How to judge them:

• HTML pages are usually sent with Cache-Control: no-cache or a short max-age so edits show up immediately.
• Fingerprinted static files (a hash in the file name) can use Cache-Control: public, max-age=31536000, immutable.
• ETag and Last-Modified enable 304 Not Modified responses. Google has said its crawlers support these conditional requests, which saves crawl budget on large sites.
• Content-Encoding: the checker tells the server it accepts compressed responses, so a missing header usually means HTML is sent without gzip or Brotli. The compression checker goes into detail.
• Vary: Accept-Encoding belongs on compressed responses so a CDN does not serve a compressed copy to a client that cannot read it.

X-Robots-Tag and other SEO-relevant headers

The checker does not score these, but you will find them in "All Response Headers":

• X-Robots-Tag: noindex keeps a page out of the index exactly like a meta robots tag — even when the HTML looks fine. A classic cause is a staging rule copied to production. See Google's documentation on robots directives.
• Link: <…>; rel="canonical" sets a canonical URL for PDFs and other non-HTML files.
• Content-Type should include charset=utf-8; without it, snippets can show garbled characters.
• Set-Cookie on every response prevents CDN caching.

Keeping PDFs out of the index with nginx:

location ~* \.pdf$ {
    add_header X-Robots-Tag "noindex, nofollow";
}

Which URLs to test

Headers come from server rules, the CMS and the CDN, and they often differ between URLs. For a complete picture, run five or six addresses: the home page, a category page, a product page or article, any CSS file or image, a PDF if you have one, and a URL that does not exist. The differences between them are your to-do list.

Checking headers with curl -I and DevTools

# Headers only (HEAD request)
curl -I https://example.com/

# Headers of a normal GET, following every redirect
curl -sSL -D - -o /dev/null https://example.com/

# Does the server send Brotli or gzip?
curl -sI -H "Accept-Encoding: br, gzip" https://example.com/ | grep -i content-encoding

curl -I sends HEAD, and some servers and CDNs answer HEAD differently from GET — when results differ, trust the second command. In a browser, open DevTools → Network → the document request → Headers.

Looking to check H1–H6 headings rather than HTTP headers? That is a different job: the on-page checker shows a page's heading structure.