HTTP header check
Every response header the URL returns, the redirects it went through, and which security headers are missing.
Common questions
- What counts towards the grade?
- Six headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options and Permissions-Policy. Each is worth the same, and the page says which ones are missing.
- Does it follow redirects?
- Yes, up to a few hops, and it shows each one. The headers graded are the ones on the page you actually land on.
- Why can't it check my internal site?
- Private, loopback and cloud-metadata addresses are refused on purpose, here and in the product. For an internal target, run a remote agent inside your network.
Watch this continuously
Free for 10 monitors · no credit card