See the exact response headers a URL returns — plus a security-header scorecard for HSTS, CSP, and the other headers that protect and rank your site.
Output / HDR
Enter a public URL above. Your live diagnostics will appear here without a login or paywall.
Every response your server sends carries headers that tell browsers, CDNs and crawlers how to treat the page. This tool fetches the live response and lists them all — then scores the security headers that matter most.
It shows the response headers a server returns for a URL — content type, caching, compression, and security headers like HSTS and Content-Security-Policy. Headers control how browsers, CDNs and crawlers treat your page, so a missing or wrong one has real consequences.
The high-value ones are Strict-Transport-Security (forces HTTPS), Content-Security-Policy (limits what can load), X-Content-Type-Options: nosniff, X-Frame-Options or frame-ancestors (clickjacking), and Referrer-Policy. This tool flags which are present and which are missing.
Yes, indirectly. Caching and compression headers affect page speed, which is a ranking factor. An X-Robots-Tag header can noindex a page just like a meta tag. And HTTPS enforcement via HSTS is part of a secure, trusted site.
Strict-Transport-Security (HSTS) tells browsers to always use HTTPS for your domain, even if a user types http://. It prevents a downgrade to an insecure connection. It is one of the cheapest security wins and is missing on a surprising number of sites.
The next question
Being crawlable is step one. The AI Visibility Checker shows whether ChatGPT, Google AI Overviews, Perplexity and Gemini name and cite your brand — and who they name instead.
Keep going