HTTP Header Checker

Security Header Analysis

Headers Present

Headers Missing

Security Score

⚠ Missing Security Headers

Content-Security-Policy
Prevents XSS attacks by specifying valid sources of content
Severity: High
X-Content-Type-Options
Prevents MIME-type sniffing attacks
Severity: Medium
X-Frame-Options
Protects against clickjacking attacks
Severity: High
Strict-Transport-Security
Enforces HTTPS connections
Severity: High
X-XSS-Protection
Enables browser's XSS filtering
Severity: Medium
Referrer-Policy
Controls how much referrer information should be included
Severity: Medium
Permissions-Policy
Controls browser features and APIs that can be used
Severity: Medium
Cross-Origin-Opener-Policy
Prevents window opener access across origins
Severity: Medium
Cross-Origin-Resource-Policy
Controls how resources can be embedded across origins
Severity: Medium

🔒 Security Recommendations

Content-Security-Policy

Add 'Content-Security-Policy' header with appropriate directives like default-src 'self'
Severity: High
X-Content-Type-Options

Set 'X-Content-Type-Options' header to 'nosniff'
Severity: Medium
X-Frame-Options

Set 'X-Frame-Options' header to 'DENY' or 'SAMEORIGIN'
Severity: High
Strict-Transport-Security

Set 'Strict-Transport-Security' header with 'max-age=31536000; includeSubDomains'
Severity: High
X-XSS-Protection

Set 'X-XSS-Protection' header to '1; mode=block'
Severity: Medium
Referrer-Policy

Set 'Referrer-Policy' header to 'strict-origin-when-cross-origin'
Severity: Medium
Permissions-Policy

Add 'Permissions-Policy' header with appropriate feature policies
Severity: Medium
Cross-Origin-Opener-Policy

Set 'Cross-Origin-Opener-Policy' header to 'same-origin'
Severity: Medium
Cross-Origin-Resource-Policy

Set 'Cross-Origin-Resource-Policy' header to 'same-origin'
Severity: Medium

Request Headers

Headers sent by your browser when making the request to the server.

Header Name	Value
host	findwhatismyip.com
user-agent	Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
accept	/
accept-encoding	gzip, br, zstd, deflate
x-forwarded-for	18.217.52.224, 34.111.179.208, 35.191.84.243,34.41.150.10

Header Name

Value

host

findwhatismyip.com

user-agent

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)

*/*

accept-encoding

gzip, br, zstd, deflate

x-forwarded-for

18.217.52.224, 34.111.179.208, 35.191.84.243,34.41.150.10

Response Headers

Headers received from the server in response to your request.

Header Name	Value
content-length	47206
content-type	text/html; charset=utf-8
date	Fri, 28 Mar 2025 18:41:43 GMT
referrer-policy	strict-origin-when-cross-origin
server	Google Frontend
strict-transport-security	max-age=63072000; includeSubDomains, max-age=31536000; includeSubDomains
x-content-type-options	nosniff
x-frame-options	SAMEORIGIN
x-xss-protection	1; mode=block
alt-svc	h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Header Name

Value

content-length

47206

content-type

text/html; charset=utf-8

date

Fri, 28 Mar 2025 18:41:43 GMT

referrer-policy

strict-origin-when-cross-origin

server

Google Frontend

strict-transport-security

max-age=63072000; includeSubDomains, max-age=31536000; includeSubDomains

x-content-type-options

nosniff

x-frame-options

SAMEORIGIN

x-xss-protection

1; mode=block

alt-svc

h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Understanding HTTP Headers

HTTP headers are key components of HTTP requests and responses that carry important information about the browser, server, and data being transferred.

Request Headers

User-Agent: Identifies your browser and operating system to the server.
Accept: Tells the server what types of content your browser can understand.
Accept-Language: Indicates your preferred language(s).
Accept-Encoding: Lists the compression methods your browser supports.
Connection: Controls whether the network connection stays open.

Security Headers

Cookie: Contains stored data from the website.
Authorization: Provides credentials for protected resources.
Origin: Indicates where the request originated from.
X-Forwarded-For: Lists IP addresses of proxies.

Cache Control Headers

Cache-Control: Directives for caching mechanisms.
If-None-Match: Used with ETag for cache validation.
If-Modified-Since: Makes requests conditional based on timestamp.

Content Headers

Content-Type: Indicates the media type of the resource.
Content-Length: The size of the response body in bytes.
Content-Encoding: The encoding used on the data.

HTTP Header Checker

Security Header Analysis

⚠ Missing Security Headers

🔒 Security Recommendations

Request Headers

Response Headers

Understanding HTTP Headers

Request Headers

Security Headers

Cache Control Headers

Content Headers

Awesome findWhatIsMyIP Blog