What does the HTTP header checker show?

The full set of response headers a URL returns, with attention to security headers such as Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, and X-Frame-Options, plus caching and redirect behaviour.

Why are security headers important?

They tell the browser to enforce HTTPS, block mixed content, restrict where scripts load from, and refuse framing, which are defences against downgrade, clickjacking, and cross-site scripting that the page itself cannot enforce.

Does the check run from my browser?

No. The site fetches the URL you enter from its server and reports what came back, so the result reflects the server's view, not your local network.

HTTP Header Checker

Check any URL

Or inspect this page's headers

Security Header Analysis

Headers Present

Headers Missing

75%

Security Score

✓ Present Security Headers

Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://www.googletagmanager.com https://www.google-analytics.com https://pagead2.googlesyndication.com https://*.googlesyndication.com https://adservice.google.com https://*.g.doubleclick.net https://*.google.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; img-src 'self' data: https:; font-src 'self' data: https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; connect-src 'self' https:; frame-src 'self' https://www.youtube.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://*.doubleclick.net https://tpc.googlesyndication.com https://*.google.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests
Restricts where scripts, styles and other content may load from — the main defence against XSS.
Severity: High
Strict-Transport-Security: max-age=31536000; includeSubDomains
Tells browsers to only ever reach this host over HTTPS.
Severity: High
X-Frame-Options: SAMEORIGIN
Legacy clickjacking protection (superseded by CSP frame-ancestors, still worth sending).
Severity: High
X-Content-Type-Options: nosniff
Stops browsers MIME-sniffing a response into a different content type.
Severity: Medium
Referrer-Policy: strict-origin-when-cross-origin
Controls how much of the URL is sent in the Referer header on outbound requests.
Severity: Medium
Permissions-Policy: geolocation=(), camera=(), microphone=(), browsing-topics=()
Opts the site out of powerful browser features (camera, geolocation, etc.).
Severity: Medium

⚠ Missing Security Headers

Cross-Origin-Opener-Policy
Isolates your browsing context from cross-origin popups (needed for some powerful APIs).
Severity: Medium
Cross-Origin-Resource-Policy
Blocks other origins from embedding your resources.
Severity: Low

🔒 Security Recommendations

Cross-Origin-Opener-Policy

Set to 'same-origin' unless you rely on cross-origin window handles.
Severity: Medium
Cross-Origin-Resource-Policy

Set to 'same-origin' (or 'same-site') for non-public resources.
Severity: Low

Request Headers

Headers sent by your browser when making the request to the server.

Header Name	Value
host	findwhatismyip.com
x-forwarded-for	216.73.216.94
connection	close
accept	/
user-agent	Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
accept-encoding	gzip, br, zstd, deflate
cache-control	public, max-age=0, must-revalidate

Header Name

Value

host

findwhatismyip.com

x-forwarded-for

216.73.216.94

connection

*/*

user-agent

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)

accept-encoding

gzip, br, zstd, deflate

cache-control

public, max-age=0, must-revalidate

Response Headers

Headers received from the server in response to your request.

Header Name	Value
connection	close
content-type	text/html; charset=utf-8
content-length	52523
cache-control	public, max-age=0, must-revalidate
etag	"9974555b95510827dbdf5e2f66d3f5ad055c2047"
date	Fri, 11 Sep 2026 03:09:57 GMT
x-content-type-options	nosniff
x-frame-options	SAMEORIGIN
x-xss-protection	1; mode=block
strict-transport-security	max-age=31536000; includeSubDomains
referrer-policy	strict-origin-when-cross-origin
permissions-policy	geolocation=(), camera=(), microphone=(), browsing-topics=()
content-security-policy	default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://www.googletagmanager.com https://www.google-analytics.com https://pagead2.googlesyndication.com https://.googlesyndication.com https://adservice.google.com https://.g.doubleclick.net https://.google.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; img-src 'self' data: https:; font-src 'self' data: https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; connect-src 'self' https:; frame-src 'self' https://www.youtube.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://.doubleclick.net https://tpc.googlesyndication.com https://*.google.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests

Header Name

Value

connection

content-type

text/html; charset=utf-8

content-length

52523

cache-control

public, max-age=0, must-revalidate

etag

"9974555b95510827dbdf5e2f66d3f5ad055c2047"

date

Fri, 11 Sep 2026 03:09:57 GMT

x-content-type-options

nosniff

x-frame-options

SAMEORIGIN

x-xss-protection

1; mode=block

strict-transport-security

max-age=31536000; includeSubDomains

referrer-policy

strict-origin-when-cross-origin

permissions-policy

geolocation=(), camera=(), microphone=(), browsing-topics=()

content-security-policy

default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://www.googletagmanager.com https://www.google-analytics.com https://pagead2.googlesyndication.com https://*.googlesyndication.com https://adservice.google.com https://*.g.doubleclick.net https://*.google.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; img-src 'self' data: https:; font-src 'self' data: https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; connect-src 'self' https:; frame-src 'self' https://www.youtube.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://*.doubleclick.net https://tpc.googlesyndication.com https://*.google.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests

Understanding HTTP Headers

HTTP headers are key components of HTTP requests and responses that carry important information about the browser, server, and data being transferred.

Request Headers

User-Agent: Identifies your browser and operating system to the server.
Accept: Tells the server what types of content your browser can understand.
Accept-Language: Indicates your preferred language(s).
Accept-Encoding: Lists the compression methods your browser supports.
Connection: Controls whether the network connection stays open.

Security Headers

Cookie: Contains stored data from the website.
Authorization: Provides credentials for protected resources.
Origin: Indicates where the request originated from.
X-Forwarded-For: Lists IP addresses of proxies.

Cache Control Headers

Cache-Control: Directives for caching mechanisms.
If-None-Match: Used with ETag for cache validation.
If-Modified-Since: Makes requests conditional based on timestamp.

Content Headers

Content-Type: Indicates the media type of the resource.
Content-Length: The size of the response body in bytes.
Content-Encoding: The encoding used on the data.

HTTP Header Checker

Check any URL

Or inspect this page's headers

Security Header Analysis

✓ Present Security Headers

⚠ Missing Security Headers

🔒 Security Recommendations

Request Headers

Response Headers

Understanding HTTP Headers

Request Headers

Security Headers

Cache Control Headers

Content Headers

Awesome findWhatIsMyIP Blog

Frequently asked questions

What does the HTTP header checker show?

Why are security headers important?

Does the check run from my browser?

HTTP Header Checker

Crypto Tools

Check any URL

Or inspect this page's headers

Security Header Analysis

✓ Present Security Headers

⚠ Missing Security Headers

🔒 Security Recommendations

Request Headers

Response Headers

Understanding HTTP Headers

Request Headers

Security Headers

Cache Control Headers

Content Headers

Awesome findWhatIsMyIP Blog

Frequently asked questions

What does the HTTP header checker show?

Why are security headers important?

Does the check run from my browser?

Related Tools

User Agent Decoder

Screen Resolution

Encryption Tool