Using an HTTP Header Checker to Audit Your Site

Introduction

An HTTP Header Checker shows the response headers returned by a website before the page content loads. Headers can reveal important technical details such as status code, redirects, content type, cache rules, security policies, cookies, server/CDN behavior and HTTPS handling.

Auditing headers helps you find problems that are not always visible in the browser. A page may look normal but still have weak security headers, incorrect cache settings, bad redirects, missing content type, exposed server details or inconsistent CDN/origin behavior.

Quick answer

HTTP header checker

An HTTP header checker is a tool that requests a URL and displays the response headers sent by the server, CDN, proxy or application.

It can show:

• HTTP status code
• redirect location
• content type
• cache rules
• security headers
• cookies
• server/CDN hints
• compression
• CORS headers
• final response after redirects

Headers help explain how the site behaves technically before the browser renders the page.

What headers reveal

Headers to check

During a basic website audit, review these header groups.

Final response

Many URLs return a redirect first. For example, HTTP may redirect to HTTPS, or non-www may redirect to www.

Audit both:

• the first response
• every redirect step
• the final response

Security, cache and content headers should be checked on the final page that users actually load.

Security audit

Security headers help browsers apply safer behavior.

• Content-Security-Policy exists and does not break resources
• Strict-Transport-Security is present only when HTTPS is ready
• X-Frame-Options or frame-ancestors protects against unwanted framing
• X-Content-Type-Options is set to nosniff
• Referrer-Policy limits referrer leakage
• Permissions-Policy disables unused browser features

Cache audit

Cache headers control how browsers and CDNs store responses.

• HTML pages are not cached too aggressively if content changes often
• static assets can use longer cache times
• private pages are not publicly cached
• CDN cache headers match your intended behavior
• cache-control does not conflict with expires
• vary headers are reasonable

Common examples:

• Cache-Control: no-cache
• Cache-Control: public, max-age=31536000, immutable
• Cache-Control: private, no-store

Cookie audit

Cookies can affect security and privacy.

Review Set-Cookie headers for:

• Secure
• HttpOnly
• SameSite
• appropriate domain
• appropriate path
• reasonable expiration
• no sensitive data in cookie values

Why this matters

Header audits are useful after migrations, SSL changes, CDN changes, security hardening, performance work and troubleshooting redirects or downtime.

How to audit headers

Use HTTP Header Checker to inspect the exact URL you want to audit.

Check in this order:

1. Exact URL — Test the homepage and important pages separately.
2. Redirects — Check HTTP to HTTPS and www/non-www behavior.
3. Final status — Confirm the final URL returns the expected status.
4. Security headers — Review CSP, HSTS, frame protection, nosniff, referrer and permissions policy.
5. Cache headers — Check cache-control, expires, ETag and CDN cache status.
6. Content headers — Review content-type and content-encoding.
7. Cookies — Check Set-Cookie flags.
8. CDN/origin headers — Identify whether the response is from CDN cache, edge or origin.

Common problems

How to fix issues

1. Step 1: Audit the final HTTPS response

   Follow redirects and review the final page users load.

2. Step 2: Separate header types

   Group findings into redirects, security, cache, cookies, content and CDN behavior.

3. Step 3: Fix high-risk items first

   Prioritize private cache leaks, broken cookies, bad redirects and missing critical protections.

4. Step 4: Add low-risk security headers

   Start with nosniff, referrer policy, frame protection and permissions policy.

5. Step 5: Test CSP and HSTS carefully

   Use report-only CSP where possible and confirm HTTPS readiness before strict HSTS.

6. Step 6: Clean cache rules

   Use different rules for HTML, static assets, private pages and API responses.

7. Step 7: Review cookies

   Add Secure, HttpOnly and SameSite where appropriate.

8. Step 8: Check CDN/origin consistency

   Avoid duplicate or conflicting headers from multiple layers.

9. Step 9: Re-test after deployment

   Run the checker again and test important user flows.

When a CDN is used, headers may be added, removed or overwritten at the edge.

• origin sets one cache rule, CDN applies another
• duplicate security headers
• HSTS added at CDN but not origin
• CSP differs between cached and uncached pages
• cookies affect CDN cache behavior
• CDN hides origin server headers
• cache status differs by region

Check headers:
curl -I https://example.com

Follow redirects:
curl -IL http://example.com

Example final response:

HTTP/2 200
content-type: text/html; charset=UTF-8
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-frame-options: SAMEORIGIN
set-cookie: session=abc; Secure; HttpOnly; SameSite=Lax

What to review:
- final status is 200
- HTTPS is active
- security headers are present
- session cookie has Secure, HttpOnly and SameSite
- cache rule is appropriate for HTML

Header checklist

Frequently asked questions