About the HTTP Header Checker
The HTTP Header Checker performs a request to any URL (following redirects to the final destination) and lists every response header the server sends — plus a security grade based on the six headers every production site should set: HSTS, CSP, X-Content-Type-Options, X-Frame-Options / frame-ancestors, Referrer-Policy and Permissions-Policy.
Use it after editing your .htaccess or server config to verify header deployment, then check certificate details with the SSL Certificate Checker.
The core set: Strict-Transport-Security (forces HTTPS), Content-Security-Policy (blocks XSS injection), X-Content-Type-Options: nosniff, X-Frame-Options or frame-ancestors (clickjacking), Referrer-Policy and Permissions-Policy. This checker grades all six.
Strict-Transport-Security tells browsers to only ever connect via HTTPS for a defined period, eliminating downgrade and SSL-stripping attacks. A typical value is max-age=31536000; includeSubDomains.
HTTP allows repeated headers (e.g. multiple Set-Cookie lines). This tool lists every occurrence separately, exactly as the server sent them.