HTTP Header Checker

Security Header Analysis

Headers Present

Headers Missing

Security Score

⚠ Missing Security Headers

Content-Security-Policy
Prevents XSS attacks by specifying valid sources of content
Severity: High
X-Content-Type-Options
Prevents MIME-type sniffing attacks
Severity: Medium
X-Frame-Options
Protects against clickjacking attacks
Severity: High
Strict-Transport-Security
Enforces HTTPS connections
Severity: High
X-XSS-Protection
Enables browser's XSS filtering
Severity: Medium
Referrer-Policy
Controls how much referrer information should be included
Severity: Medium
Permissions-Policy
Controls browser features and APIs that can be used
Severity: Medium
Cross-Origin-Opener-Policy
Prevents window opener access across origins
Severity: Medium
Cross-Origin-Resource-Policy
Controls how resources can be embedded across origins
Severity: Medium

🔒 Security Recommendations

Content-Security-Policy

Add 'Content-Security-Policy' header with appropriate directives like default-src 'self'
Severity: High
X-Content-Type-Options

Set 'X-Content-Type-Options' header to 'nosniff'
Severity: Medium
X-Frame-Options

Set 'X-Frame-Options' header to 'DENY' or 'SAMEORIGIN'
Severity: High
Strict-Transport-Security

Set 'Strict-Transport-Security' header with 'max-age=31536000; includeSubDomains'
Severity: High
X-XSS-Protection

Set 'X-XSS-Protection' header to '1; mode=block'
Severity: Medium
Referrer-Policy

Set 'Referrer-Policy' header to 'strict-origin-when-cross-origin'
Severity: Medium
Permissions-Policy

Add 'Permissions-Policy' header with appropriate feature policies
Severity: Medium
Cross-Origin-Opener-Policy

Set 'Cross-Origin-Opener-Policy' header to 'same-origin'
Severity: Medium
Cross-Origin-Resource-Policy

Set 'Cross-Origin-Resource-Policy' header to 'same-origin'
Severity: Medium

Request Headers

Headers sent by your browser when making the request to the server.

Header Name	Value
host	findwhatismyip.com
x-forwarded-for	216.73.216.59
connection	keep-alive
accept	/
user-agent	Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
accept-encoding	gzip, br, zstd, deflate

Header Name

Value

host

findwhatismyip.com

x-forwarded-for

216.73.216.59

connection

keep-alive

*/*

user-agent

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)

accept-encoding

gzip, br, zstd, deflate

Response Headers

Headers received from the server in response to your request.

Header Name	Value
connection	keep-alive
server	nginx/1.26.3 (Ubuntu)
date	Thu, 09 Oct 2025 09:53:07 GMT
content-type	text/html; charset=utf-8
transfer-encoding	chunked
x-content-type-options	nosniff
x-frame-options	SAMEORIGIN
x-xss-protection	1; mode=block
strict-transport-security	max-age=31536000; includeSubDomains
referrer-policy	strict-origin-when-cross-origin
content-encoding	gzip

Header Name

Value

connection

keep-alive

server

nginx/1.26.3 (Ubuntu)

date

Thu, 09 Oct 2025 09:53:07 GMT

content-type

text/html; charset=utf-8

transfer-encoding

chunked

x-content-type-options

nosniff

x-frame-options

SAMEORIGIN

x-xss-protection

1; mode=block

strict-transport-security

max-age=31536000; includeSubDomains

referrer-policy

strict-origin-when-cross-origin

content-encoding

gzip

Understanding HTTP Headers

HTTP headers are key components of HTTP requests and responses that carry important information about the browser, server, and data being transferred.

Request Headers

User-Agent: Identifies your browser and operating system to the server.
Accept: Tells the server what types of content your browser can understand.
Accept-Language: Indicates your preferred language(s).
Accept-Encoding: Lists the compression methods your browser supports.
Connection: Controls whether the network connection stays open.

Security Headers

Cookie: Contains stored data from the website.
Authorization: Provides credentials for protected resources.
Origin: Indicates where the request originated from.
X-Forwarded-For: Lists IP addresses of proxies.

Cache Control Headers

Cache-Control: Directives for caching mechanisms.
If-None-Match: Used with ETag for cache validation.
If-Modified-Since: Makes requests conditional based on timestamp.

Content Headers

Content-Type: Indicates the media type of the resource.
Content-Length: The size of the response body in bytes.
Content-Encoding: The encoding used on the data.

HTTP Header Checker

Security Header Analysis

⚠ Missing Security Headers

🔒 Security Recommendations

Request Headers

Response Headers

Understanding HTTP Headers

Request Headers

Security Headers

Cache Control Headers

Content Headers

Awesome findWhatIsMyIP Blog