What are HTTP headers?
Every time a browser asks for a web page, the server replies with the page plus a set of HTTP response headers. These are invisible instructions such as "this is HTML", "keep a copy for one hour", "this content is gzip-compressed" or "only load this site over HTTPS". Headers affect speed, security and even SEO, so checking them is part of any technical audit.
This HTTP header checker shows:
- the final status code, response time and number of redirects
- whether compression (gzip or Brotli) is turned on
- the Cache-Control header that controls browser caching
- an X-Robots-Tag warning if headers block indexing
- six important security headers, each marked Set or Missing
- the complete raw list of headers
How to use the header checker
- Enter the full URL, including https:// if you know it.
- Click Check headers.
- Review the summary first, then the security section, then the full table.
The security headers we check
| Header | What it does |
|---|---|
| Strict-Transport-Security (HSTS) | Forces browsers to always use HTTPS |
| Content-Security-Policy | Limits where scripts and other files can load from |
| X-Frame-Options | Stops other sites from showing yours in a frame |
| X-Content-Type-Options | Prevents browsers from guessing file types |
| Referrer-Policy | Controls what address is shared with other sites |
| Permissions-Policy | Restricts camera, microphone and location access |
You do not need every header on day one, but HSTS, X-Content-Type-Options and X-Frame-Options are easy to add on most servers. The OWASP Secure Headers Project gives recommended values, and MDN's header reference explains each one in detail.
Headers and SEO
A few headers matter directly for search. X-Robots-Tag: noindex hides a page from Google just like a meta robots tag, and it is easy to miss because it is not in the HTML. Compression and caching make pages load faster, which helps users and Core Web Vitals. And the status code tells crawlers whether the page exists at all.
Follow up with the Redirect Checker to trace redirects, the SSL Checker to test your certificate and the Page Size Checker to see how heavy the page is.
When to check headers
Check your headers after moving to a new host, installing a security or caching plugin, setting up a CDN such as Cloudflare, or changing your server configuration. These changes often add or remove headers without anyone noticing. A quick check with this tool, the Redirect Checker and the Website SEO Audit confirms nothing broke.
Important headers and what they do
| Header | Purpose |
|---|---|
Content-Type | Tells the browser what the file is, for example text/html; charset=UTF-8 |
Cache-Control | Controls how long browsers and CDNs keep a copy |
Content-Encoding | Shows if the response is compressed with gzip or Brotli |
Strict-Transport-Security | Forces browsers to use HTTPS for your domain (HSTS) |
Content-Security-Policy | Limits which scripts, styles and images can load, reducing XSS risk |
X-Content-Type-Options | nosniff stops browsers guessing file types |
X-Frame-Options | Stops other sites placing your pages in an iframe (clickjacking) |
Referrer-Policy | Controls how much of your URL is sent to other sites |
Permissions-Policy | Turns off browser features you do not use, such as camera or microphone |
X-Robots-Tag | Indexing rules for search engines, useful for PDFs and images |
The MDN reference on HTTP headers explains each one in detail.
How to add missing security headers
Where you add headers depends on your hosting:
- Apache / cPanel: add
Header setlines in your.htaccessfile, for exampleHeader set X-Content-Type-Options "nosniff". - Nginx (VPS): add
add_headerlines inside theserverblock, for exampleadd_header Referrer-Policy "strict-origin-when-cross-origin" always;, then reload Nginx. - Cloudflare: use Transform Rules to add response headers without touching the server.
- WordPress: a security plugin can add the common headers for you.
Start with the safe ones: X-Content-Type-Options, Referrer-Policy and X-Frame-Options. Add HSTS only when you are sure the whole site, including subdomains you include, works on HTTPS. Add Content-Security-Policy last and test carefully, because a strict policy can block your own scripts.
Caching headers and speed
Good caching makes repeat visits much faster. Static files such as images, CSS and JavaScript can be cached for a long time, for example Cache-Control: public, max-age=31536000 when the file name changes on every update. HTML pages usually need a short cache or no-cache so visitors always see fresh content. If you see no Content-Encoding header on an HTML page, compression is probably off; turning on gzip or Brotli often shrinks HTML by 60-80 percent. Check the effect with the Page Size Checker.
Headers that affect indexing
An X-Robots-Tag: noindex header removes a file from Google just like a robots meta tag, and it is easy to miss because it is invisible in the page source. Always check headers when a page or PDF disappears from search. Also confirm that important pages return status 200, not a redirect or an error. For redirects, the Redirect Checker shows the full chain, and for certificates use the SSL Checker.
Example: finding why a PDF is missing from Google
A company's price list PDF never appears in Google, although it is linked from the website. The PDF has no HTML, so there is no meta tag to check. Running the PDF's URL through the header checker shows X-Robots-Tag: noindex, added years ago by a server rule meant for a private folder. Removing that rule and requesting a re-crawl in Search Console fixes the problem. Headers are invisible in the browser window, which is why checking them directly saves hours of guessing.
Frequently Asked Questions
What is a good response time?
Under about 800 milliseconds for the HTML is good. Slow servers often need caching or better hosting.
Why are some headers shown twice?
Some headers, such as Set-Cookie, can legally appear more than once. We show them all.
Can I check headers of a non-HTML file?
Yes, any public URL works, including images, PDFs and scripts.
Do you store results?
No, nothing is saved.
Do security headers improve Google rankings?
Not directly. They protect your visitors and your site. HTTPS itself is a ranking signal, and HSTS helps make sure visitors always use it.
Why does the server header show my software version?
Many servers announce their name and version by default. Hiding the version (server_tokens off in Nginx, ServerTokens Prod in Apache) gives attackers less information.
What does Vary: Accept-Encoding mean?
It tells caches to store separate copies for compressed and uncompressed responses, which is correct when compression is on.
Last updated: October 25, 2026