HTTP headers of a URL

What NetCheck shows

NetCheck sends a request to the address you enter from its own servers, follows redirects one by one, then shows for the final response:

• the status code and the number of redirects followed;
• the declared server and the response time;
• a summary of the security headers present or missing;
• the full list of headers, for detailed analysis.

Status codes worth knowing

Security headers

• Strict-Transport-Security (HSTS) forces the browser to use only HTTPS for the domain for a set period, which defeats attacks that try to downgrade to HTTP. Common value: max-age=31536000; includeSubDomains.
• Content-Security-Policy (CSP) lists the allowed sources for scripts, styles, images and frames. It is the best defence against script injection (XSS), and the trickiest to tune: a policy that is too strict breaks the site.
• X-Frame-Options, or the CSP frame-ancestors directive, prevents the page from being embedded in a frame on another site, which blocks clickjacking.
• X-Content-Type-Options: nosniff stops the browser from guessing a file's type, a classic way to get booby-trapped content executed.
• Referrer-Policy limits how much of its address the page passes on to the sites it links to.
• Permissions-Policy disables sensitive features the site does not need: camera, microphone, geolocation.

A missing header is not a vulnerability in itself, but each one closes off a whole family of attacks at almost no cost.

Redirects and SEO

Each redirect adds a network round trip and slightly dilutes the signal sent to search engines. Aim for at most one redirect between the address typed and the final page. A typical chain to fix: http://example.com, then https://example.com, then https://www.example.com, then https://www.example.com/home. It is better to redirect the first address straight to the last one.

Caching

• Cache-Control says who may keep the response and for how long. no-store forbids any storage, max-age=3600 allows one hour.
• ETag and Last-Modified let the browser ask for the page again only if it has changed, which produces a very light 304 response.
• Age, added by CDNs, shows how many seconds the response has been cached.

Frequently asked questions

Why does the result differ from what I see in my browser?

The request comes from NetCheck's servers, not from your computer. A site may respond differently depending on the country, language, cookies or type of client, and some firewalls block automated requests with a 403. The result is still representative of what a bot, such as a search engine, sees.

Is the “Server” header a risk?

It reveals the software used, sometimes its version, which helps an attacker target known flaws. Hiding the version is good practice, but not protection in itself: keeping the server up to date matters far more.

Should I use a 301 or a 302 to move to HTTPS?

A 301 (or a 308), since the change is permanent. Then add the HSTS header so the browser no longer even tries the HTTP version.

My site returns 200 but the page is empty or shows an error: what is going on?

Some applications display an error page while still returning a 200 code. Search engines call this a “soft 404” and end up ignoring those pages. A page that does not exist should return a real 404.