HTTP Headers Checker

What response headers do

Each time a page is requested, the server sends a set of headers along with it. They tell the browser how to cache the page, which content type and encoding it uses, and what security limits apply. Most site owners never see them unless they check on purpose, yet badly set headers can slow a site, leak data or leave it open to attack.

Six security headers worth setting on any site

• Strict-Transport-Security (HSTS): instructs browsers to connect over HTTPS and nothing else. Give it a long max-age, for example max-age=31536000.
• Content-Security-Policy (CSP): your best protection against XSS, listing which scripts and styles are allowed to load.
• X-Content-Type-Options: nosniff: blocks attacks that rely on MIME-type confusion.
• X-Frame-Options: SAMEORIGIN: keeps other sites from placing yours inside an iframe, which prevents clickjacking.
• Referrer-Policy: strict-origin-when-cross-origin: a sensible default that gives away less through the Referer header.
• Permissions-Policy: turns off browser features your site has no use for, such as the camera, microphone or geolocation.

Caching headers, which affect speed and SEO

• Cache-Control: sets how long browsers and CDNs may keep the response.
• ETag / Last-Modified: allow browsers to revalidate a cached copy cheaply.
• Vary: names the parts of a request, such as User-Agent or Cookie, that change the response.

Every SiteBoma page sends all six of these security headers. Run siteboma.com through the checker to see them for yourself.