HTTP Header Checker

Start with the six core security headers: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Then review caching directives like Cache-Control, ETag, and Last-Modified, plus the Content-Type and any Server or X-Powered-By headers that reveal your stack. This tool groups them all for you and flags which security headers are present versus missing.

HSTS tells browsers to only connect over HTTPS, which blocks downgrade and man-in-the-middle attacks after the first visit. If it's missing, your site is sending the header on no response or hasn't been configured at the server/CDN level, so add a Strict-Transport-Security header (e.g. max-age=31536000; includeSubDomains). It's one of the simplest high-impact security wins, which is why this checker calls it out when absent.

Cache-Control sets caching rules (max-age in seconds, plus directives like no-store, private, or public), while Expires is an older absolute-date fallback. ETag and Last-Modified let browsers and CDNs revalidate cheaply with conditional requests instead of re-downloading unchanged files. This tool buckets all of these under Content & Caching so you can confirm static assets cache aggressively and HTML pages don't cache stale content.

Often yes. The Server and X-Powered-By headers can expose the web server and framework, while CDN fingerprints like cf-ray (Cloudflare), Via, x-cache, and x-amz-id-2 (AWS) reveal the delivery layer. This checker groups those under Server, which is useful for competitor research and for spotting tech you may want to hide, since exposing detailed version strings can aid attackers.

Run a header check periodically and compare the results, since changes to HSTS, CSP, the Server header, or CDN fingerprints can signal an infrastructure or security migration. SiteGauge can re-check a URL's response headers on a schedule and alert you when security headers, CDN, or server setup change, so you don't have to poll manually. That makes header drift useful for both competitive intelligence and your own compliance monitoring.