HTTP & security headers

Review response headers, redirect chains, and security posture in one call.

If a site blocks scanner traffic, you can configure your server/CDN to allow one custom header and set it here.

How to read a headers report

Use this page to audit production responses from an external perspective. The goal is not only to see if headers exist, but to confirm they stay consistent across redirects and match your intended policy.

Status + final URL
Validate expected destination and status code class before reviewing security controls.
Redirect chain
Check every hop for policy drift, temporary redirects, and host canonicalization mistakes.
Security impact
Use the impact notes to prioritize missing protections by risk and rollout order.
For deeper response analysis, pair this report with HTTP Deep Check and Security Headers Scorecard.

FAQ

Most important headers?
Start with HSTS, CSP, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy, then expand for your application model.
Why redirects matter?
Users and bots traverse redirects, so weak headers on any hop can still create risk or inconsistent behavior.
Can some be missing by design?
Yes, but missing headers should be explicitly justified and tracked as policy decisions, not accidental gaps.

Related guides

How to fix robots, noindex, and X-Robots conflicts

Resolve crawl and index directive mismatches across robots, meta, and headers.

How to avoid soft 404 issues on tool pages

Improve perceived page quality and avoid thin template classification.

Canonical tags vs redirects for duplicate URLs

Choose the right consolidation strategy for duplicate URL variants.