Is missing CSP always critical?

No. It is a warning here. How serious it is depends on the app. We do not call the site hacked.

Does HSTS apply on HTTP?

No. HSTS only matters after HTTPS. On HTTP we skip it with a notice: redirect to https first.

What does bulk mode return?

Status codes for up to 50 URLs. Open a URL on its own for the full header list.

Why might my laptop see different headers?

A CDN or WAF can vary by region and by bot versus browser. This is the response our fetch received.

Is this a CORS debugger?

No. Access-Control headers are shown if present. We do not simulate a browser origin.

Why is example.com a Warning?

The chip follows the worst security row. example.com on HTTPS had HSTS missing and No CSP (both warnings), then missing X-Frame-Options, X-Content-Type-Options, and Referrer-Policy (notices). Pass requires those headers to be present on this response.

Why is a list different from one URL?

One URL is GET plus the full dump. Two or more lines, max 50, use HEAD first so a sweep stays light, then GET if HEAD is refused. You still get a card and status per line. Open a URL alone when you need every header name.

Does Fetch headers grade TLS?

No. Status and headers only. Expiry, SANs, and protocol versions belong on SSL Checker. A 200 with missing HSTS is still a Warning here even when the certificate is valid.

HTTP Header Checker

Loading tool…

About HTTP Header Checker

Enter a URL and click Fetch headers for a GET of that URL. You see every header we received plus a short security checklist. Enter more than one URL (one per line, max 50) and bulk mode uses HEAD first, then GET if HEAD is refused, and returns status codes for the list.

JavaScript is not executed. CDN or edge headers can differ from what your laptop sees. CORS is listed if present; this is not a full CORS debugger.

When to use it

Use it after a CDN, WAF, or host change, when Strict-Transport-Security or Content-Security-Policy may have dropped off the live response. That is also the check a security ticket asks for: are those five headers on this URL right now, not in a staging config file.

Use the 50-line list when you only need status codes across a path set. Open one URL alone for the raw dump. This is not SSL Labs and not a CORS lab.

How to use HTTP Header Checker

1Enter a URL or a list. One URL per line for bulk status. A single URL shows the full header dump.
2Click Fetch headers. We do not run JavaScript.
3Scan the security rows. Present versus missing, with a why line.
4Copy a header. Useful for a ticket. Remember CDN responses can differ by location.

Security headers on this page

HSTS is skipped as a notice on plain HTTP; on HTTPS, missing Strict-Transport-Security is a warning. Missing Content-Security-Policy is a warning; Content-Security-Policy-Report-Only is a notice. Missing X-Frame-Options, X-Content-Type-Options, and Referrer-Policy are notices.

A missing CSP is not a claim that the site is compromised. It means the header was not in this response. Frame protection can also come from CSP frame-ancestors; we still report X-Frame-Options separately.

How to read the results

One URL is a GET. You get HTTP status, a Warning, Notice, or Pass chip from the worst security row, the issue list, and a raw name: value dump. example.com on HTTPS came back 200 with Warning: HSTS missing and No CSP, plus notices for X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.

Two or more lines switch to bulk: HEAD first, then GET if HEAD is refused, and a card per URL. Fix warnings before notices. HSTS skipped on HTTP is expected; send HTTPS first. Copy a line from the dump for a ticket. CDN answers can differ by region.

Why this matters

Without Strict-Transport-Security, the first request to a host can stay on HTTP and be rewritten in transit. The browser only learns to force HTTPS after it has seen that header on an HTTPS response, which is why HSTS is skipped on plain HTTP here.

A missing Content-Security-Policy leaves script sources unconstrained, which is the usual XSS door. Report-Only watches and does not block. X-Frame-Options and CSP frame-ancestors are how a page refuses to be framed. Those are response facts, not ranking signals.

Limits and privacy

A single address is GET. A list is clipped to 50 lines and uses HEAD, then GET if HEAD is refused. Loopback and reserved ranges never leave the form. About 20 fetches per minute on your network. The dump is this response, not a world map of every POP. No login.

Common mistakes

Reading No CSP as proof the site is compromised. It only means the header was absent on this fetch.

Checking http:// and expecting HSTS to pass. The row is HSTS skipped on HTTP. Fetch the https URL.

Treating this dump as what every visitor sees. A CDN or WAF can vary by region and by bot versus browser. Re-check from another network if a ticket disagrees.

FAQs

Is missing CSP always critical?: No. It is a warning here. How serious it is depends on the app. We do not call the site hacked.
Does HSTS apply on HTTP?: No. HSTS only matters after HTTPS. On HTTP we skip it with a notice: redirect to https first.
What does bulk mode return?: Status codes for up to 50 URLs. Open a URL on its own for the full header list.
Why might my laptop see different headers?: A CDN or WAF can vary by region and by bot versus browser. This is the response our fetch received.
Is this a CORS debugger?: No. Access-Control headers are shown if present. We do not simulate a browser origin.
Why is example.com a Warning?: The chip follows the worst security row. example.com on HTTPS had HSTS missing and No CSP (both warnings), then missing X-Frame-Options, X-Content-Type-Options, and Referrer-Policy (notices). Pass requires those headers to be present on this response.
Why is a list different from one URL?: One URL is GET plus the full dump. Two or more lines, max 50, use HEAD first so a sweep stays light, then GET if HEAD is refused. You still get a card and status per line. Open a URL alone when you need every header name.
Does Fetch headers grade TLS?: No. Status and headers only. Expiry, SANs, and protocol versions belong on SSL Checker. A 200 with missing HSTS is still a Warning here even when the certificate is valid.