What are HTTP Headers?
HTTP headers are metadata sent between your browser and a web server with every request and response. They control caching, security, content type, and more.
Important Headers
| Header | Purpose |
|---|---|
Server | Web server software (nginx, Apache, etc.) |
Content-Type | Format of the response (HTML, JSON, etc.) |
Cache-Control | How long to cache the response |
X-Powered-By | Backend technology (often hidden for security) |
Security Headers
| Header | What it does |
|---|---|
Strict-Transport-Security (HSTS) | Forces HTTPS connections |
Content-Security-Policy (CSP) | Controls which resources can load |
X-Frame-Options | Prevents clickjacking (embedding in iframes) |
X-Content-Type-Options | Prevents MIME-type sniffing |
Referrer-Policy | Controls how much referrer info is sent |
Security Score
We check for three key security headers: HSTS, CSP, and X-Frame-Options. A score of 3/3 means all essential security headers are present.