# HTTP Header Checker

URL: https://tools.otaku-dojo.com/en/http-header-checker
Updated: 2026-10-03

The HTTP Header Checker requests a URL (following redirects) and lists the final response's status code and every header, grouped three ways: the status of six security headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), caching-related headers, and the complete header list.

## How to use the HTTP Header Checker

1. Enter a URL and press "Check".
2. The top shows the status code, security header score, response time and server software.
3. Yellow items under "Security headers" are recommended additions.
4. Press "Copy" for a plain-text header list.

## Specs & key facts

- **Shows**: Status code, response time, all response headers
- **Security checks**: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy
- **Caching checks**: Cache-Control, Expires, ETag, Last-Modified, Age, Vary, Content-Encoding
- **Redirects**: Followed (up to 10); headers of the final URL are shown
- **Limits**: Public URLs only, 20 checks per minute
- **Price**: Free, no sign-up

## Examples: Recommended security headers (Nginx)

```nginx
Missing HSTS, X-Content-Type-Options, Referrer-Policy
```

→

```nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
```

## FAQ

### Does a low security header score hurt SEO?

Security headers are not a direct ranking factor, but HTTPS with HSTS keeps users and crawlers on secure connections, and headers like CSP reduce the risk of a compromise that gets your site flagged.

### Why are the results different from my browser's developer tools?

Servers may vary headers by User-Agent, cookies or region, and CDNs have different edges. This tool makes a logged-out request from our server.

### How should Cache-Control be set?

Versioned static files (CSS, JS, images) can use public, max-age=31536000, immutable; HTML pages usually use a short max-age or no-cache so updates appear promptly.