Website Diagnostics
Server Headers Checker
Inspect a deliberately selected set of response and security headers returned by a public HTTP or HTTPS website.
Check response headers
Set-Cookie, authentication and session values are excluded. The tool shows only a fixed allowlist rather than an unlimited raw header dump.
Response headers versus request headers
This page shows selected headers a website returns to WhatWebSees. The existing HTTP Headers Checker instead shows a limited selection of request headers your browser sent to the WhatWebSees origin.
Useful security headers
Strict-Transport-Security can ask browsers to prefer HTTPS. Content-Security-Policy constrains permitted resource sources. X-Content-Type-Options helps prevent content-type sniffing, while Referrer-Policy controls referrer information sent during navigation.
Headers are clues, not a complete audit
A missing or present header alone does not prove a site is secure. Policies must be appropriate for the application, and some values may be added by a CDN or reverse proxy.
What this result means
Headers are clues about this response, not a full security audit. Values can vary by URL, CDN edge, method and negotiation, and a present policy can still be poorly configured.