HTTP Header Checker: Security, Cache and SEO Headers

How to use it

Enter a URL. Any page, file or API endpoint. Redirects are followed to the final URL.
Read the headers. Every header the server sent, sorted by name.
Work the checklist. Security, caching, compression and indexing headers, each with a plain fix when something is missing.

What response headers tell you

Before a browser renders anything, the server sends headers: instructions about caching, security, content type and whether the page may be indexed. They are invisible on the page, which is why problems here go unnoticed for months.

Headers that affect SEO

X-Robots-Tag. The header version of a robots meta tag. A stray noindex here keeps a page out of Google even when the HTML looks fine. Common on PDFs and on staging configs that leak into production.
Cache-Control, ETag, Last-Modified. Good caching makes repeat visits fast and lets crawlers revalidate pages cheaply instead of downloading them again.
Content-Encoding. Brotli or gzip compression cuts HTML and CSS transfer size by 70% or more. It is one of the cheapest speed wins there is.
Content-Type. A page served as text/plain will not render as HTML. A sitemap served as text/html may be ignored.

Security headers worth sending

Strict-Transport-Security (HSTS) forces HTTPS on every future visit.
Content-Security-Policy limits which scripts can run, the main defence against cross-site scripting.
X-Content-Type-Options: nosniff stops browsers guessing file types.
X-Frame-Options or CSP frame-ancestors stops other sites framing your pages for clickjacking.
Referrer-Policy and Permissions-Policy control what you leak to other sites and which browser features pages can use.

None of these are direct ranking factors, but they protect visitors and the trust signals that do matter. Most can be added in one place: your CDN, host or framework config.

Check where a URL lands first with the redirect checker, and confirm your certificate with the SSL checker.

What you get

Full response header table
Six-point security header check
Cache-Control, ETag and Last-Modified
Compression and server detection
X-Robots-Tag noindex warning

Questions

How do I check the HTTP headers of a website?

Paste the URL above. We request it from our servers, follow any redirects, and list every header the final response sent, with a checklist of the important ones.

What is X-Robots-Tag?

An HTTP header that carries the same instructions as a robots meta tag, such as noindex or nofollow. It works on any file type, including PDFs and images, which is why it is easy to forget about.

Which security headers should every site have?

At minimum HSTS, X-Content-Type-Options: nosniff, a clickjacking defence (X-Frame-Options or CSP frame-ancestors) and a Referrer-Policy. A Content-Security-Policy is strongly recommended but takes more care to set up.

Do security headers affect SEO?

Not directly. Google does not rank pages higher for having a CSP. They matter indirectly: a hacked or spam-injected site loses rankings fast, and HTTPS enforced by HSTS is a confirmed signal.

Why is Content-Encoding missing when my site is compressed?

Some CDNs only compress when the client asks with Accept-Encoding, and a few proxies decode before passing the response on. We ask for Brotli and gzip like a browser does, so a missing header usually means compression is really off.