HTTP Headers Checker

HTTP response headers are metadata sent by a web server alongside the page content. They control how browsers interpret and handle the response — including caching behaviour (Cache-Control), content type (Content-Type), security policies (Content-Security-Policy, X-Frame-Options), cookie attributes, and compression. Security headers instruct browsers on how to protect users from common web attacks. Checking response headers reveals both security posture and technical configuration.

The most impactful security headers are: Content-Security-Policy (prevents XSS), Strict-Transport-Security (enforces HTTPS), X-Content-Type-Options: nosniff (prevents MIME sniffing), X-Frame-Options or frame-ancestors CSP directive (prevents clickjacking), Referrer-Policy (controls referrer information), and Permissions-Policy (restricts browser feature access). Missing or misconfigured security headers are listed in OWASP's Top 10 as a significant risk category.

X-Content-Type-Options: nosniff instructs browsers not to perform MIME type sniffing — the practice of overriding the declared Content-Type header based on the actual content of the response. Without this header, browsers may execute a JavaScript file even if it is served with a non-JavaScript MIME type, or render HTML even when served as text/plain. Enabling nosniff ensures resources are only interpreted according to their declared Content-Type.

Header differences between environments (local, staging, production) typically stem from different web server configurations. Nginx and Apache configs that add security headers may not be present in development environments. CDN providers (Cloudflare, Fastly, Akamai) often add or modify headers. Load balancers may strip or add headers. Always test headers in production or a staging environment that mirrors the production server config exactly, as development environments are rarely representative.