Lists all the HTTP response headers a server returns, helping you diagnose security, caching and server configuration.
What Is an HTTP Header?
With every web request, the server sends a set of response headers along with the content. These headers carry metadata such as the content type, caching rules, security policies and server information. Inspecting headers is the fastest way to diagnose performance and security issues.
Headers to Watch
- Server / X-Powered-By: Server and technology information (hiding it is recommended for security).
- Cache-Control / Expires: Browser caching behavior.
- Content-Encoding: Compression (gzip/br).
- Strict-Transport-Security, X-Frame-Options, Content-Security-Policy: Security headers.
How Do You Use It?
- Enter the full URL (
https://ornek.com). - Review the returned headers and add any missing security headers.
Tip: Security headers such asStrict-Transport-SecurityandX-Content-Type-Options: nosniffharden your site against common attacks.
Frequently Asked Questions
Should I hide the Server header?
It is recommended. Exposing your server and version information can give attackers clues about known vulnerabilities.
Which security headers should be present?
At a minimum you should have HSTS, X-Frame-Options, X-Content-Type-Options and, if possible, Content-Security-Policy.
