How to Check Security Headers on a Live Site

How to read headers in general (status, cache, content-type) is How to read HTTP headers when debugging a site. This page is the security-relevant subset and the mistakes those audits make.

How to fetch them

HTTP Header Viewer for a URL you operate. The hostname is sent - that is the job. Compare https://www.example.com and https://example.com; they can disagree.

SSL Certificate Checker for names on the cert and expiry. DNS Record Lookup if you are on the wrong IP. Meta Tag Extractor for noindex and robots in HTML - different layer than X-Robots-Tag.

Headers worth a first pass

Strict-Transport-Security (HSTS). Tells HTTPS-capable browsers to skip HTTP next time. Missing on a site that should be HTTPS-only is a common finding. max-age too small is a weak finding. Preload lists are a separate commitment - do not tick preload without understanding lock-in.

Content-Security-Policy. Restricts scripts, frames, connect-src. default-src * and unsafe-inline everywhere is a CSP in name only. A missing CSP is common. A broken CSP that blocks your own app is worse than none until you fix it. Report-only mode exists for a reason.

X-Frame-Options / frame-ancestors. Clickjacking. DENY or SAMEORIGIN unless you intend embeds.

X-Content-Type-Options: nosniff. Stops MIME sniffing. Cheap win.

Referrer-Policy. How much URL leaks in Referer. Not the same as CSRF.

Permissions-Policy. Camera, geolocation. Noise unless you use those APIs.

Set-Cookie. Secure, HttpOnly, SameSite. The viewer shows what the first response set. SPAs that set cookies later in JS are a different hunt.

X-Robots-Tag. noindex on production is a launch incident. Pre-launch checklist.

Server / X-Powered-By. Fingerprinting. Nice to hide; not a breach.

What a missing header does not mean

You are not “grade F therefore pwned.” Automated graders disagree with each other. Fix HSTS and cookies on the real checkout origin first, not on a marketing microsite, if you have limited time.

CDN vs origin: the viewer sees the edge. Your origin might send different headers internally. Both can be right.

TLS is next door

Headers will not show a cert that does not match the name. Users see the padlock warning first. How SSL certificates work and how to check expiry.

A worked example: new www cutover

DNS is new (Why DNS changes aren’t showing). Header viewer on https://www.example.com: no HSTS, X-Frame-Options missing, cookie session= without Secure. SSL checker: cert is for the old load balancer name, not www. Fix cert first (site is scary), then cookie flags, then HSTS once you are sure HTTPS works everywhere (including apex redirect).

Do not enable HSTS preload the same afternoon you are still debugging mixed content.

Limits of a browser tool

No authenticated crawl. No proof that CSP is enforced on every path. No discovery of admin.example.com. Use your lab and a real scanner if you need that. The viewer is the “what does this URL send today” check.

Probe only what you own. The networking catalog: Best free networking diagnostic tools.

Security headers are instructions to browsers, visible on the response. HTTP Header Viewer plus SSL Certificate Checker cover the two layers people mix up. They will not replace a review, and they will catch the noindex and missing Secure cookies you would have shipped on Friday.

Cross-origin and APIs

The viewer on www.example.com does not show headers on api.example.com. Check the API origin too. CORS headers (Access-Control-Allow-Origin: * with credentials) are a finding. A * on a public marketing API may be fine. On a cookie-authenticated API it is not.

Redirect chains

HTTP → HTTPS → www. Headers on the first 301 can differ from the 200. View the final URL and the first hop. HSTS on the HTTPS 200 does not help if nobody gets there.

Report-Only CSP

Content-Security-Policy-Report-Only is a dress rehearsal. Auditors who only grep Content-Security-Policy will say “missing” while you are still measuring breakages. Know which you meant to ship.

Cookies on parent domains

Set-Cookie for .example.com vs www. The viewer on one host may not show the other. Check both.

What to do with a finding

Ticket: origin, header name, current value, desired value, CDN vs app who owns it. Do not “add HSTS” on a host that still serves mixed content. Do not copy a CSP from a blog post that blocks your analytics and your app.

They will catch the noindex and missing Secure cookies you would have shipped on Friday. HTTP Header Viewer is the fetch. Your CDN config is the fix.

COOP/COEP and embedders

Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy break third-party widgets if copied blindly. Do not paste a “strict” header pack from a blog. Measure.

Expect-CT is gone

Old checklists still mention it. Skip. Look at Certificate Transparency in the SSL tool era, not Expect-CT.

Reporting endpoints

report-uri / Reporting-Endpoints send browser reports to a URL. If that URL is dead, you get no signal. The header viewer shows the policy, not whether reports arrive.

HSTS preload is a lock-in, not a trophy

Submitting to the preload list is a multi-month commitment. Do it after HTTPS works on apex and www, after mixed content is gone, and after you understand that removing preload is slow. A header viewer that shows preload in HSTS is not a grade. It is a promise.

Turning on HSTS while http:// still serves a different app (or a parking page) trains browsers to skip HTTP - including the path you still needed for a redirect experiment.

CSP nonce vs unsafe-inline

A CSP that allows 'unsafe-inline' for scripts is a CSP sticker. Nonces or hashes are the grown-up version and they break the first copy-paste from a blog. Measure in report-only. HTML Encoder will not write your CSP for you.

security.txt is not a header

/.well-known/security.txt is a file. Auditors mix it with headers. Fine to have; it does not replace HSTS. The header viewer will not fetch it unless you ask for that URL.

Mixed content after you “fixed HTTPS”

HSTS on the HTML origin does not upgrade every third-party script. The viewer on the document URL will not list every subresource. DevTools console will. Fix mixed content before you brag about HSTS.

A one-hour header pass that is not a vendor letter grade

1. SSL Certificate Checker on the names users type.
2. HTTP Header Viewer on apex, www, and the API origin - final 200 and the first 301.
3. Cookies: Secure, HttpOnly, SameSite on the session cookie you actually use.
4. X-Robots-Tag / HTML noindex on production.
5. CSP: present vs report-only vs unsafe-inline everywhere.
6. Write tickets with owner (CDN vs app), not a screenshot of a letter grade.

Probe only what you own. Skip Expect-CT checklists. Skip copying COOP/COEP from a post that assumes you have no third-party widgets.

www cookies that never reach apex

Users type the apex. You set Secure cookies on www only. The header viewer on www looks perfect and checkout on the apex looks logged-out. Check both hosts. Align redirects so there is one canonical origin before you argue about SameSite.

CDN “security pack” templates

A one-click Cloudflare/Akamai pack can inject X-Frame-Options: DENY that breaks a partner iframe you still need. The viewer shows the pack. The fix is an exception on that path, not turning the pack off globally - and not pasting a second CSP that fights the first.

Staging headers copied to production

A preview deploy with X-Robots-Tag: noindex is correct. Promoting that config to the production CDN is a launch incident. Compare headers on the hostname in ads, not only on staging.. Pre-launch checklist.

Permissions-Policy vs the cookie banner

Blocking camera/geolocation in Permissions-Policy is cheap. Copying a policy that disables payment or fullscreen can break checkout widgets. The viewer shows the string. Product still has to say which APIs you meant to allow.

Your CDN config is the fix. HTTP Header Viewer is the observation. SSL Certificate Checker is the padlock.