Question 1

What is an HTTP header analyzer?

Accepted Answer

An HTTP header analyzer fetches the response headers from any URL and displays them in a structured, human-readable format. It checks for the presence and correct configuration of security headers, cache directives, content type settings, CORS policies, and more — helping developers and IT admins identify misconfigurations at a glance.

Question 2

Why do HTTP security headers matter?

Accepted Answer

HTTP security headers are instructions sent by a web server that tell the browser how to handle the site's content. Missing or misconfigured headers are one of the most common and easily exploitable web security weaknesses. Headers like Content-Security-Policy, HSTS, and X-Frame-Options can prevent XSS attacks, clickjacking, and protocol downgrade attacks.

Question 3

What is Content Security Policy (CSP)?

Accepted Answer

Content-Security-Policy (CSP) is an HTTP header that controls which resources (scripts, styles, images, fonts) a browser is allowed to load for your page. A strong CSP is one of the most effective defences against Cross-Site Scripting (XSS) attacks. A missing or overly permissive CSP (e.g. using 'unsafe-inline') significantly increases XSS risk.

Question 4

What is HSTS (HTTP Strict Transport Security)?

Accepted Answer

Strict-Transport-Security (HSTS) tells browsers to always connect to your site over HTTPS, even if the user types http:// in the address bar. This prevents protocol downgrade attacks and cookie hijacking over HTTP. A recommended HSTS policy includes a long max-age (at least 1 year), includeSubDomains, and optionally preload.

Question 5

What security headers should every website have?

Accepted Answer

Every website should have at minimum: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options: nosniff, X-Frame-Options or CSP frame-ancestors, and Referrer-Policy. Modern sites should also consider Permissions-Policy to restrict access to browser APIs like camera and microphone.

Question 6

Do HTTP headers affect SEO?

Accepted Answer

Indirectly yes. Google uses HTTPS as a ranking signal, and HSTS helps enforce HTTPS consistently. Core Web Vitals can be affected by cache headers (Cache-Control) — well-configured caching improves load time and therefore PageSpeed scores. A missing or broken Content-Type header can cause resources to be parsed incorrectly, affecting rendering performance.

Question 7

What is X-Frame-Options and why does it matter?

Accepted Answer

X-Frame-Options tells the browser whether your page is allowed to be embedded in an iframe on another site. Setting it to DENY or SAMEORIGIN prevents clickjacking attacks, where an attacker overlays your site in a transparent iframe to trick users into clicking on hidden elements. Modern sites should use the CSP frame-ancestors directive instead, which is more flexible.

Question 8

Is my URL or response data stored anywhere?

Accepted Answer

No. The header fetch is performed directly from your browser using a CORS proxy or direct request. No URLs you analyse are logged or stored on any server by this tool. Results exist only in your browser session and are gone when you close the tab.

🌐 Language

Frequently Asked Questions — HTTP Header Analyzer