HTTP Header Checker and Security Headers Check
Análise dos cabeçalhos de resposta HTTP: segurança, cache, compressão, CORS.
Fatos principais
Check a website's HTTP headers online: enter an address and get every response header, a security score from 0 to 100 (HSTS, CSP, X-Frame-Options and five more) and caching and compression details. No sign-up. The tool checks server headers, not the H1–H6 tags on a page.
- Preço
- Grátis
- Cadastro
- Não é necessário
- Processamento
- On our server: we send a GET request to the address, follow redirects and parse the headers of the final response
- Entrada
- One public URL or domain (https:// is added automatically)
- Limites
- 30 checks per minute per IP; we wait up to 15 seconds; up to 10 redirects; one URL at a time
- Resultado
- All HTTP response headers, a 0–100 security score based on 8 headers plus HTTPS, a caching and compression block (Cache-Control, ETag, Last-Modified, Content-Encoding, Vary, Content-Type), status code, time, the Server header
- Última atualização
Verificação de cabeçalhos HTTP: segurança e cache
Check the HTTP response headers of any URL: security headers (CSP, HSTS, X-Frame-Options), caching and compression. A percentage score for security headers present and the full header list, including X-Robots-Tag.
Como usar
- Informe a URL para verificar os cabeçalhos
- Clique em "Verificar" para analisar
- Confira a pontuação de segurança e a lista de cabeçalhos
Casos de uso
- Run quick header security checks on dev, staging, and production.
- Validate cache policy and CORS behavior for pages and APIs.
Limitações
- Shows headers for a specific URL, not the full site structure.
- Some headers are added only on edge/CDN and may vary by path.
Exemplo de entrada / resultado
https://example.com
Security score B with missing Content-Security-Policy and X-Frame-Options.
FAQ
PromoPilot vs. alternativas: comparação
Comparamos apenas o que está confirmado nas páginas de cada serviço. Onde não conseguimos confirmar um dado, a célula mostra "—".
| Parâmetro | PromoPilot | MDN HTTP Observatory | KeyCDN HTTP Header Checker | httpstatus.io |
|---|---|---|---|---|
| Grátis e limites | Yes: 30 checks per minute, no sign-up | Any domain can be scanned; a rescan only once every 60 seconds | A free online curl test; limits not stated | A web tool; terms and prices not stated (the API says “get started for free”) |
| Security grade | Score 0–100 for the presence of 8 headers and HTTPS | ✓ letter grade and numeric score | ✗ | ✗ |
| Analysis of header values | ✗ | ✓ policy tests (CSP, Referrer-Policy and others) | ✗ | ✗ |
| Several URLs at once | ✗ | — | — | ✓ up to 100 URLs simultaneously |
| Custom request headers (Referer etc.) | ✗ | — | ✓ Referer and X-Pull, Brotli/Gzip option | — |
| Caching and compression block | ✓ | — | — | — |
| Headers for each redirect step | ✗ | Tests that the HTTP→HTTPS redirect stays on the same host | — | ✓ up to ten redirects with headers, bodies and timings |
Role a tabela para os lados
Onde somos mais fracos: the score counts only whether headers are present and does not parse their values; there is no multi-URL check, custom request headers or headers of intermediate redirects.
Quando escolher o PromoPilot: When you want every response header in seconds and a quick view of which protective headers are missing, plus caching and compression. The score counts only whether a header is present, so for a deep analysis of values (such as CSP quality) use a dedicated security scanner.
Verificado em: . "—" significa que não foi confirmado na página oficial; condições e preços mudam, então confira os sites dos próprios serviços.
