HTTP Headers Checker
Fetch and inspect every HTTP response header your server sends for any URL. Find missing security headers, check your cache policy, verify your X-Robots-Tag configuration, and see exactly what browsers and crawlers receive alongside your pages.
What Are HTTP Response Headers?
When a browser or crawler requests a URL, the server sends back two things: the response body (the HTML, JSON, or file content) and a set of response headers. Headers are key-value pairs that travel alongside the body and tell the client how to handle the response. They control caching behavior, security policy, content type, redirect instructions, and crawl permissions.
Request headers (sent by the browser to the server) are different from response headers (sent by the server back to the browser). This tool inspects response headers only: what your server is actually sending back. Most developers never inspect these until something breaks. Many common SEO and security problems are caused entirely by missing or misconfigured response headers.
Security Headers Every Indie Maker Site Should Have
Sites graded by securityheaders.com receive scores from A+ to F. Most new SaaS products and indie maker tools score D or lower because security headers are not set by default in any major framework. These five headers address the most common attack vectors and take under 10 minutes to add.
Forces all browsers to use HTTPS, even if a user types http:// directly. The max-age value sets how long this rule is cached (2 years is standard). Adding preload and submitting to the HSTS preload list ensures browsers never make an insecure connection to your domain, even on first visit.
Stops browsers from guessing the MIME type of a response. Without this header, browsers may interpret a JSON response as HTML and execute malicious script content inside it. One word, zero configuration, prevents a real class of attack.
Prevents your pages from being embedded in iframes on external domains. Clickjacking attacks overlay invisible iframes on top of your UI to trick users into clicking UI elements they cannot see. DENY blocks all iframes; SAMEORIGIN allows iframes only from your own domain.
Controls how much URL information is passed in the Referer header when users click links away from your site. The recommended value sends the full URL for same-origin requests and only the origin (domain without path) for cross-origin requests, protecting sensitive URL parameters.
Restricts which browser APIs your pages can access. Setting camera and microphone to empty denies access by default, which prevents malicious third-party scripts injected via XSS from silently accessing device hardware.
Headers That Directly Affect SEO and Crawling
X-Robots-Tag
The server-level equivalent of the HTML meta robots tag. Use it to send noindex, nofollow, or noai directives for pages where you cannot add HTML — PDFs, API responses, dynamically generated files. Googlebot and AI crawlers both respect this header. If you accidentally set X-Robots-Tag: noindex on your homepage, it will be deindexed even if the HTML has no meta robots tag.
Cache-Control
Controls how long CDNs and browsers cache your page before requesting a fresh version. Common values: max-age=3600 caches for one hour, no-cache forces revalidation on every request, no-store prevents all caching. For SEO, a generous max-age on static assets improves Core Web Vitals. For frequently updated pages, a short max-age or stale-while-revalidate pattern keeps content fresh while serving cache hits.
Last-Modified and ETag
These two headers let crawlers detect whether a page has changed since their last visit. Googlebot uses them to skip re-crawling unchanged pages, which preserves crawl budget for pages that actually have new content. If neither header is present, Googlebot must download and compare the full page body on every visit.
Link: rel=canonical
An HTTP-level canonical declaration sent via response header rather than an HTML tag. This is the only way to declare canonical URLs for non-HTML resources. Google respects HTTP-level canonical headers. If your HTML canonical and your HTTP header canonical conflict, Google will treat the canonical as ambiguous.
How to Add Security Headers in Next.js
Add a headers() function to your next.config.js. The source pattern /(.*) matches every route. After deploying, run this tool against your domain to verify the headers appear in the response:
// next.config.js
module.exports = {
async headers() {
return [
{
source: '/(.*)',
headers: [
{
key: 'Strict-Transport-Security',
value: 'max-age=63072000; includeSubDomains; preload',
},
{
key: 'X-Content-Type-Options',
value: 'nosniff',
},
{
key: 'X-Frame-Options',
value: 'DENY',
},
{
key: 'Referrer-Policy',
value: 'strict-origin-when-cross-origin',
},
{
key: 'Permissions-Policy',
value: 'camera=(), microphone=(), geolocation=()',
},
],
},
]
},
}HTTP Headers and AI Crawlers
AI crawlers including GPTBot, ClaudeBot, and PerplexityBot respect HTTP response headers the same way Googlebot does. The most important header for AI visibility is X-Robots-Tag: if your server returns X-Robots-Tag: noai or X-Robots-Tag: noindex, AI crawlers are directed to skip your page entirely. This tool lets you verify that your pages are configured to allow the crawlers you want, and that no accidental header is blocking your content from being indexed and cited by AI systems.
Frequently Asked Questions
How do I add security headers to a Next.js app?
Add a headers() async function to your next.config.js file. It returns an array of header objects, each with a source pattern (the URL path to match) and an array of key-value header pairs. Setting source to '/(.*)'applies the headers to every page on your site. After adding headers, deploy your app and use this tool to verify they appear in the response.
What security headers does Google check for SEO rankings?
Google does not use security headers as direct ranking signals. However, HTTPS (enforced by Strict-Transport-Security) is a confirmed ranking factor. Security headers protect user trust and prevent attacks that could cause pages to be compromised or deindexed. The indirect SEO benefit comes from site safety: Google demotes sites flagged for malware or deceptive content, which security headers help prevent.
What is the difference between X-Frame-Options and Content-Security-Policy frame-ancestors?
X-Frame-Options is an older header that tells browsers whether your page can be embedded in an iframe. It supports values DENY (no iframes allowed) and SAMEORIGIN (iframes only from your own domain). Content-Security-Policy frame-ancestors is the modern replacement and is more flexible, allowing you to whitelist specific domains. CSP frame-ancestors takes precedence over X-Frame-Options in browsers that support both. For new sites, prefer CSP frame-ancestors.
How do I add an X-Robots-Tag header without changing my HTML?
Use the X-Robots-Tag HTTP response header instead of a meta robots tag in the HTML. In Next.js, add it in the headers() function in next.config.js. On Vercel, you can set it in vercel.json under the headers array. X-Robots-Tag is especially useful for noindexing non-HTML resources like PDFs or API JSON responses where you cannot add a meta tag.
What does Cache-Control: no-store mean for SEO?
Cache-Control: no-store tells browsers and CDNs not to store any version of the page. This means every request hits your origin server. For SEO, Googlebot respects cache directives when deciding whether to re-crawl a page, but no-store does not cause Google to deindex a page. The SEO risk of no-store is performance: if your server is slow, uncached responses increase Time to First Byte (TTFB), which is a Core Web Vitals input. For public content, prefer a cache policy that allows CDN caching.
Related tools