KitJade
Network & CybersecurityAPI-assisted

HTTP Header Checker

Response headers plus a practical security-header audit.

Use the HTTP Header Checker tool

Uses a KitJade API for the live checkUpdated Report a problem

What this http header checker does

HTTP Header Checker requests a URL and reports the status line, redirect chain and every response header it receives. A built-in audit then grades the headers that matter most for browser security: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and frame protection.

The request is made by a Cloudflare Worker with strict SSRF protections: only public http and https destinations are allowed, private and link-local addresses are blocked, and the response is capped in size and time. Your browser cannot read cross-origin response headers directly, which is why a small server-side component is required for this tool.

Why use it

  • Audit a site's security headers before a penetration test or launch.
  • Debug caching, CORS and redirect behaviour after a deployment.
  • Check that HSTS is sent with a sensible max-age and includes subdomains.

How to use it

  1. 1Enter a full URL, including https://.
  2. 2Press Check to follow redirects and capture the final response.
  3. 3Review the status code, final URL and headers.
  4. 4Read the security audit: passed, missing and recommended values.

Worked examples

Missing HSTS

Input

https://example.com

Output

Strict-Transport-Security missing · recommended: max-age=31536000; includeSubDomains

Only enable includeSubDomains after every subdomain supports HTTPS.

CSP present

Input

A site with a restrictive policy

Output

Content-Security-Policy present · check for unsafe-inline and wildcard sources

Common mistakes

  • Adding a CSP with unsafe-inline and unsafe-eval, which removes much of its protection.
  • Sending HSTS with includeSubDomains while some subdomains are HTTP-only.
  • Checking headers on a staging host and assuming production is configured identically.

Frequently asked questions

Why can't my browser read these headers itself?
The same-origin policy hides most response headers from cross-origin JavaScript. A server-side request is needed to inspect arbitrary sites.
Is it safe to check internal URLs?
No. The checker deliberately blocks localhost, private ranges and cloud metadata endpoints so it cannot be used to probe internal networks.
Which headers does the audit grade?
Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options and the CSP frame-ancestors directive.

Related tools

All tools

SSL Certificate Checker

Check TLS issuer, expiry and covered domains.

API-assisted

DNS Lookup

Query DNS records over DoH with multiple record types.

Public IP Lookup

See your public IP, ISP, ASN and approximate location.

IPv4 Subnet Calculator

Network, broadcast, host range and binary working for IPv4.

Runs locally