HTTP Headers Checker
Send a GET or HEAD request to any URL and inspect the full response headers.
Written by Anil Gautam · Updated
What does the security header report check?
The report looks for six response headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. A tick means the header is present, and its value is printed beside it, but the tool does not grade that value. Strict-Transport-Security: max-age=31536000; includeSubDomains tells browsers to use only HTTPS for 31,536,000 seconds, which is 365 days, on the domain and every subdomain. A value of max-age=0 earns the same tick, although it tells browsers to forget the rule.
X-Content-Type-Options has one meaningful value, nosniff, and X-Frame-Options should read DENY or SAMEORIGIN. Referrer-Policy: strict-origin-when-cross-origin sends other sites only the page's origin, such as https://example.com, without the path. Permissions-Policy: camera=(), microphone=() turns those features off for the page and any frames inside it.
A cross matters less in two cases. Some sites deliver their Content-Security-Policy in an HTML meta tag, which never shows up among the headers, so the report marks it missing. If the policy includes a frame-ancestors rule, modern browsers follow that rule and ignore X-Frame-Options, so a cross on that header is less of a gap.
Should you use GET or HEAD?
HEAD asks for the headers without the page body, so it is lighter, but some servers answer it differently: a 405 Method Not Allowed, another status code or a shorter header list. If a HEAD result looks odd, run GET before drawing conclusions. The status badge is color-coded, green for 2xx, blue for 3xx, amber for 4xx and red for 5xx, and the time beside it is in milliseconds.
Why might the headers differ from what your browser receives?
The request comes from a server: your browser sends the URL and method to the OneClickUse server, which hands them to a separate network service that fetches the address. That request carries no cookies from your session, so you see the logged-out response, and a CDN may return different headers depending on where a request comes from. Addresses that only exist on your machine or office network, such as localhost or an intranet host, cannot be reached at all.
Beyond the security list, scan the full header list, sorted A to Z, for cache-control (max-age=3600 allows one hour of caching), content-encoding (br or gzip when compression is on), cookie flags such as Secure, HttpOnly and SameSite in set-cookie, and server or x-powered-by values that reveal software versions. Copy all puts every header on its own line as name: value, ready to paste into a ticket. For certificate details, use the SSL Certificate Checker.