HTTP header inspector
Live-fetches a URL and shows all response headers plus a security-header verdict.
How this tool works
The HTTP header inspector fetches your URL server-side (not in the browser), follows up to 5 redirects and shows every response header of the final response. It then grades the nine most important security headers — Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy and Cross-Origin-Embedder-Policy. You see at a glance where your site or your client domain has gaps.
Typical use cases
- Document the security header baseline before a pentest or security audit
- After rolling out a new CSP policy, verify it is delivered correctly
- In cookie conflicts, read out Set-Cookie with all flags (HttpOnly, Secure, SameSite)
- Inspect cache headers (Cache-Control, ETag, Last-Modified) for performance reviews
- Spot stale software versions via Server and x-powered-by headers
Frequently asked questions
Which security headers are essential today?
At minimum HSTS (max-age ≥ 31536000), a restrictive CSP (default-src 'self' or stricter), X-Content-Type-Options: nosniff, and Referrer-Policy. Without these four, a site is not configured to modern standards.
Does the tool follow redirects?
Yes — up to 5 redirects. The headers of the final response are shown. The redirect checker shows each hop with its status and target.
Which user agent is used?
A dedicated user agent: "XICTRAQ-Tools/1.0 (+https://www.xictraq.com/de/tools)". Sites that wish to block XICTRAQ explicitly can do so in robots.txt or their WAF.
What does this check show beyond a pure security-header grader?
We show ALL headers (not just security ones), grade in DE/EN, keep data in memory (no history log) and are GDPR-compliant on EU hosting. Plus you can promote the check to our 24/7 monitoring.
Does the tool grade cookie flags?
It shows every Set-Cookie header with all flags. A dedicated score component for cookie hardening is in progress.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.