📡 HTTP Response Header Inspector
Enter a URL to fetch every response header and inspect security, cache, CORS, and more — with explanations.
📖 What this check tells you
A browser reads the response headers before it reads a byte of HTML, and they decide much of how it behaves. This check performs a real GET and lists what came back, pulling out the headers that matter for security, caching and compression. Headers are the setting most often believed to be in place when it is not — a CDN or reverse proxy rewrites them in transit, or nginx overwrites what the application set — so always confirm against a real response.
| Item | What it means | How to fix it |
|---|---|---|
Strict-Transport-Security |
Once sent, the browser will use HTTPS for that domain even if a link says http://. It closes the downgrade window a man-in-the-middle would otherwise have. | Send max-age=31536000; includeSubDomains. Including subdomains will instantly break any HTTP-only subdomain, so move them all to HTTPS first. |
X-Content-Type-Options |
With nosniff the browser trusts the declared Content-Type instead of guessing from the bytes. It stops a file uploaded as an image but actually containing HTML from being executed as HTML. |
Send X-Content-Type-Options: nosniff on every response. It has virtually no downside and is essential if you serve user uploads or a JSON API. |
Content-Security-Policy |
Declares to the browser which sources of scripts and images are allowed. It is the last line of defence that keeps a successful XSS from exfiltrating anything. | Enforcing it cold will break the page. Run Content-Security-Policy-Report-Only for a few days first, add the legitimate domains that show up in the reports, and only then switch to enforcing. |
Compression (Content-Encoding) |
Without gzip or br, your HTML and JavaScript are going over the wire uncompressed — three to five times the bytes, and it shows up directly in load time. | On nginx, gzip on; is not enough — list application/javascript and application/json in gzip_types. By default only text/html is compressed. |
Headers can be rewritten at any hop. To work out where one is added or lost along app → PHP-FPM → nginx → CDN, the quickest move is to run the same check against the origin URL that bypasses the CDN and compare the two.