Enter a URL to see the response headers it returns, along with a quick read on its key security headers.
Headers control caching, content types, cookies, and security. For site owners and developers they're the quickest way to confirm a server is configured the way you expect. For everyone else, the security headers are a useful signal of how seriously a site takes safety.
For a focused security grade, try the security header analyzer, or check a site's SSL certificate.
They're extra information a server sends with every response, covering things like content type, caching, cookies, and security policies. Browsers act on them behind the scenes.
The important ones are HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. This tool flags which are present.
Some servers only return certain headers on full page loads, or strip them behind a CDN. This tool reads what the server returns for the URL you enter.