# HTTP Header Checker

> See every HTTP response header for any URL, then check HSTS, CSP, X-Frame-Options, caching, compression and X-Robots-Tag, with what to fix first.

Use it free at https://swipetolaunch.com/tools/http-header-checker

## How to use it

1. **Enter a URL.** Any page, file or API endpoint. Redirects are followed to the final URL.
2. **Read the headers.** Every header the server sent, sorted by name.
3. **Work the checklist.** Security, caching, compression and indexing headers, each with a plain fix when something is missing.

## What response headers tell you

Before a browser renders anything, the server sends headers: instructions about caching, security, content type and whether the page may be indexed. They are invisible on the page, which is why problems here go unnoticed for months.

## Headers that affect SEO

- **X-Robots-Tag.** The header version of a robots meta tag. A stray `noindex` here keeps a page out of Google even when the HTML looks fine. Common on PDFs and on staging configs that leak into production.
- **Cache-Control, ETag, Last-Modified.** Good caching makes repeat visits fast and lets crawlers revalidate pages cheaply instead of downloading them again.
- **Content-Encoding.** Brotli or gzip compression cuts HTML and CSS transfer size by 70% or more. It is one of the cheapest speed wins there is.
- **Content-Type.** A page served as `text/plain` will not render as HTML. A sitemap served as `text/html` may be ignored.

## Security headers worth sending

- **Strict-Transport-Security (HSTS)** forces HTTPS on every future visit.
- **Content-Security-Policy** limits which scripts can run, the main defence against cross-site scripting.
- **X-Content-Type-Options: nosniff** stops browsers guessing file types.
- **X-Frame-Options** or CSP **frame-ancestors** stops other sites framing your pages for clickjacking.
- **Referrer-Policy** and **Permissions-Policy** control what you leak to other sites and which browser features pages can use.

None of these are direct ranking factors, but they protect visitors and the trust signals that do matter. Most can be added in one place: your CDN, host or framework config.

Check where a URL lands first with the [redirect checker](/tools/redirect-checker), and confirm your certificate with the [SSL checker](/tools/ssl-certificate-checker).

## What you get

- Full response header table
- Six-point security header check
- Cache-Control, ETag and Last-Modified
- Compression and server detection
- X-Robots-Tag noindex warning

## Questions

### How do I check the HTTP headers of a website?

Paste the URL above. We request it from our servers, follow any redirects, and list every header the final response sent, with a checklist of the important ones.

### What is X-Robots-Tag?

An HTTP header that carries the same instructions as a robots meta tag, such as noindex or nofollow. It works on any file type, including PDFs and images, which is why it is easy to forget about.

### Which security headers should every site have?

At minimum HSTS, X-Content-Type-Options: nosniff, a clickjacking defence (X-Frame-Options or CSP frame-ancestors) and a Referrer-Policy. A Content-Security-Policy is strongly recommended but takes more care to set up.

### Do security headers affect SEO?

Not directly. Google does not rank pages higher for having a CSP. They matter indirectly: a hacked or spam-injected site loses rankings fast, and HTTPS enforced by HSTS is a confirmed signal.

### Why is Content-Encoding missing when my site is compressed?

Some CDNs only compress when the client asks with Accept-Encoding, and a few proxies decode before passing the response on. We ask for Brotli and gzip like a browser does, so a missing header usually means compression is really off.