HTTP Header Checker
Inspect live response headers, status, content type, caching, and security headers. This live check sends only the URL or domain you enter to ToolkitPoint’s server and the named authoritative service.
How to use HTTP Header Checker
- Enter the page address in "Public URL", using https:// where possible.
- Press "Run live check" (after any human-verification step) to have the server fetch the address and follow redirects to the last response.
- Read the header bar with the HTTP status, final URL, Server value and Content-Type.
- Inspect the "Security Headers Audit" card, which marks six headers as Present or Missing and shows a percentage score.
- Use "Copy All Headers" or the Copy button on a single row of the "Response Headers" table to take the values away.
Worked example
Suppose a page answers with only Strict-Transport-Security and X-Content-Type-Options: nosniff among the six audited headers. The audit card reads 2 / 6 Configured with a 33% badge in the danger colour, the two headers show Present and the other four show Missing with a note that the header was not detected. The status pill would show HTTP 200 OK.
When to use this tool
- Checking whether a newly deployed site sends HSTS and nosniff.
- Copying the full header list into a bug report about caching.
- Confirming a CDN change did not strip the Content-Security-Policy header.
Important limitations
Performs an automated HTTP request from the ToolkitPoint server. Results reflect the response observed from the server location and may differ from local browser requests due to geo-routing, CDN edges, or Cloudflare bot protections.
Frequently asked questions
Which security headers are scored?
Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or a frame-ancestors rule in the policy), X-Content-Type-Options set to nosniff, Referrer-Policy and Permissions-Policy. Each counts equally, so two of six shows 33 percent.
Is a high percentage proof the site is secure?
No. The score only records whether each header exists, not whether its value is sensible. A permissive policy still counts as Present, and many other protections are outside the list.
Whose headers am I seeing?
Those returned to ToolkitPoint's server, after any redirects, for an anonymous request. A CDN or bot filter may send different headers to it than to your browser or to a logged-in user.
Why does Server say Hidden / CDN edge?
That text appears when the response has no Server header. Many sites remove it deliberately to reveal less, so its absence is neutral rather than an error.
Does a Missing badge mean I must add the header?
Not necessarily. For example Permissions-Policy or a strict CSP suit some sites more than others, and X-Frame-Options is redundant when frame-ancestors is present. Weigh each against your own application.