Question 1

Which security headers are scored?

Accepted Answer

Six modern hardening headers: HSTS (Strict-Transport-Security), CSP (Content-Security-Policy), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Score is a 0–6 count of the headers present and non-empty.

Question 2

Does it follow redirects?

Accepted Answer

Yes. The full redirect chain is shown — each hop's status code, Location target, and final destination — so you can spot redirect loops, mismatched HTTPS upgrades, and accidental 302s where 301s were intended.

Question 3

Why are some headers missing that I see in browser DevTools?

Accepted Answer

DevTools shows what the browser parsed; some servers strip security or caching headers when the request looks like a bot. We send a normal Accept-Language and User-Agent, but a small fraction of sites still return reduced headers to us.

Question 4

Will the request show up in my server logs?

Accepted Answer

Yes — it's a real HTTPS request from our server to the URL you entered. If you're inspecting a private staging site, expect to see the hit in your access log.

HTTP Headers Inspector

More Website Tools

OG Image Generator

DNS Lookup

Meta Tag Inspector

The all-in-one work dashboard for small teams