HTTP Headers Checker
Inspect HTTP response headers, detect missing security policies (HSTS, CSP, X-Frame-Options), and generate server configuration snippets.
What are HTTP Security Headers?
HTTP security headers are response directives that tell the browser how to behave when handling your website's content. By configuring headers like Strict-Transport-Security and Content-Security-Policy, you activate the browser's native security sandbox to prevent XSS, clickjacking, and protocol downgrade attacks.
Security Headers Recommended Cheat Sheet
Industry-standard baseline configurations recommended by OWASP for production web applications.
| Header | Recommended Value | Mitigates |
|---|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains; preload | SSL-stripping & Man-in-the-Middle (MitM) |
| Content-Security-Policy | default-src 'self'; script-src 'self' ... | Cross-Site Scripting (XSS) & Data Injection |
| X-Frame-Options | SAMEORIGIN (or DENY) | Clickjacking & UI Redressing |
| X-Content-Type-Options | nosniff | MIME-type sniffing exploits |
| Referrer-Policy | strict-origin-when-cross-origin | URL parameter and path privacy leakage |
| Permissions-Policy | camera=(), microphone=(), geolocation=() | Unauthorized browser device & sensor access |
Why Proper Header Configuration Matters
Attack Surface Reduction
Headers like Content-Security-Policy and X-Frame-Options neutralize client-side injection attacks even if your code has minor template flaws.
Caching & Latency
Cache-Control and Content-Encoding (Brotli / Gzip) headers inform edge CDNs and browsers how to compress and cache assets for sub-second page loads.
Infrastructure Privacy
Removing X-Powered-By and genericizing Server banners prevents automated vulnerability botnets from fingerprinting your software stack.
Frequently Asked Questions
What are HTTP security headers and why are they critical?
HTTP security headers are response directives sent by your server to tell the browser how to behave when rendering content. Setting these headers activates built-in browser defenses to block Cross-Site Scripting (XSS), Clickjacking, MIME-sniffing, and protocol downgrade attacks.
How do I achieve an A+ Security Grade on this checker?
To obtain an A+ grade, configure HSTS with a max-age of at least 31536000 seconds including subdomains and preload, implement a strict Content-Security-Policy (CSP) that avoids 'unsafe-inline' and 'unsafe-eval', set X-Frame-Options to SAMEORIGIN or DENY, enable X-Content-Type-Options nosniff, and define a restrictive Referrer-Policy.
What is the difference between HTTPS and HSTS?
HTTPS encrypts the data transmitted between client and server. However, initial requests often start as unencrypted HTTP before redirecting. HSTS (Strict-Transport-Security) instructs the browser to never use unencrypted HTTP for your domain in the first place, completely blocking SSL-stripping attacks.
Why should I hide or genericize the Server and X-Powered-By headers?
Revealing exact server software and backend framework versions (e.g., Apache/2.4.41 or Express) provides attackers with precise reconnaissance data to search public CVE exploit databases for known vulnerabilities targeting your specific stack.
Can security headers break my website?
Yes, especially Content-Security-Policy (CSP) if configured too strictly without whitelisting required third-party script/font domains. We recommend testing CSP using the `Content-Security-Policy-Report-Only` header before enforcing it in production.