What security headers should every website have?

Essential security headers: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.

What does the Strict-Transport-Security header do?

HSTS tells browsers to always use HTTPS for your domain, preventing SSL stripping attacks. It should include max-age=31536000 and includeSubDomains.

Why check HTTP headers for SEO?

Headers like X-Robots-Tag can prevent indexing, Cache-Control affects page speed, and missing canonical headers can cause duplicate content issues.

What does X-Frame-Options prevent?

X-Frame-Options DENY or SAMEORIGIN prevents your pages from being embedded in iframes on other sites, protecting users from clickjacking attacks.

← Tous les outils / HTTP Header Analyzer

🔬

Analyseur d'en-tête HTTP

Inspect HTTP response headers for any URL. Check security headers, caching, redirects, server info, and SEO-relevant headers. Free developer tool.

HTTP Security Headers — Why They Matter

HTTP response headers tell the browser how to behave when serving your content. Security headers protect against XSS, clickjacking, and data injection attacks. Missing security headers are flagged by Google's Lighthouse and security scanners.

Header	Purpose	Impact
`Strict-Transport-Security`	Force HTTPS	Security
`Content-Security-Policy`	Prevent XSS	Security
`X-Frame-Options`	Block clickjacking	Security
`X-Content-Type-Options`	Prevent MIME sniffing	Security
`Cache-Control`	Browser caching	Performance
`X-Robots-Tag`	Noindex/nofollow	Référencement

Outils associés

Recherche DNS
Recherche d'adresse IP
Vérificateur de certificat SSL
← Tous les outils