HTTP Headers Guide:
Security, Caching & Performance

HTTP Headers: The Invisible Infrastructure

Every web request starts with headers. Before the HTML loads, before the JavaScript executes, before the CSS renders — dozens of key-value pairs travel between browser and server, establishing the rules of engagement. Content-Type determines how the browser interprets the response. Cache-Control tells CDNs and browsers how long to keep a copy. Content-Security-Policy defines which scripts are allowed to run. Strict-Transport-Security locks the domain to HTTPS for months. These headers shape security, performance, and compatibility — yet most developers never look at them unless something breaks.

An HTTP header viewer lets you inspect the response headers from any URL. You type a domain, it fetches the page, and it shows you every header the server returned. For your own sites, this is a quick security and performance audit. For third-party services, it's reconnaissance — understanding what technology they use, how they configure caching, and whether they've deployed standard security headers. The information is public. Most developers just never look.

The Security Headers You're Probably Missing

Content-Security-Policy (CSP). The single most important security header. CSP tells the browser which sources of content are allowed — scripts from your domain only, styles from your CDN, images from anywhere, frames from nowhere. Without CSP, an XSS vulnerability means an attacker's script runs with full access to the page. With CSP properly configured, the browser blocks injected scripts even if XSS exists. CSP is complex to configure — most sites that start implementing it spend weeks in "report-only" mode, collecting violation reports before enforcing. Start with default-src 'self' and tighten from there. A header viewer shows you whether CSP is present and, if so, what policy is in place.

Strict-Transport-Security (HSTS). One line that prevents SSL stripping attacks forever. max-age=31536000; includeSubDomains; preload tells browsers: "for the next year, always use HTTPS for this domain and all its subdomains." Once a browser sees this header, it refuses HTTP connections — even if the user types "http://" in the address bar. The preload directive submits your domain to browsers' built-in HSTS lists, protecting the very first visit before any header is received. Check for this header. If it's missing, adding it takes five minutes and dramatically improves your site's transport security.

X-Frame-Options. Prevents your page from being loaded in an iframe on another domain. Set it to DENY (never allow framing) or SAMEORIGIN (allow framing only by your own domain). This stops clickjacking attacks where a malicious site overlays your page transparently and tricks users into clicking buttons they can't see. CSP's frame-ancestors directive is the modern replacement, but X-Frame-Options still provides defense-in-depth for older browsers.

X-Content-Type-Options: nosniff. One header, one value. Prevents the browser from "sniffing" the content type — guessing whether a file is HTML, JavaScript, or something else based on its content rather than the Content-Type header. Without nosniff, attackers can upload a file that looks like an image but contains executable JavaScript, and the browser's MIME-sniffing will execute it.

Caching Headers and Performance

Cache-Control is the most important performance header. Cache-Control: public, max-age=31536000, immutable tells browsers and CDNs: "cache this file for a year and never revalidate it." Use this for versioned static assets (styles.a1b2c3.css, logo.v4.png). Cache-Control: no-cache tells the browser to always revalidate with the server before using a cached copy — useful for HTML pages that change frequently. Cache-Control: no-store tells browsers to never cache the response at all — required for pages with sensitive data like banking statements. If your site loads slowly on repeat visits, check these headers. An incorrect Cache-Control value makes browsers re-download assets they should cache, or serve stale content they should refresh.

The ETag header works alongside Cache-Control. When a browser has a cached resource, it sends the ETag value back to the server in an If-None-Match request header. If the ETag matches the current version, the server returns 304 Not Modified with no body — the browser uses its cached copy. This saves bandwidth for resources that haven't changed. If Cache-Control says "ask the server" but the server doesn't send ETags, every request downloads the full resource even when it hasn't changed. A header viewer shows you both headers side by side, revealing whether your caching strategy is coherent or contradictory.

Reading the Server Header

The Server header announces the web server software and sometimes its version number: Server: nginx/1.24.0, Server: Apache/2.4.57 (Ubuntu), Server: cloudflare. Security best practice is to suppress or genericize this header — it tells attackers exactly which exploits to try. A known vulnerability in nginx 1.23.x is useless against a server that only reports Server: nginx. Most reverse proxies (Cloudflare, AWS CloudFront, Fastly) strip or overwrite the Server header. Check what your site reveals. If the header includes version numbers, configure your web server to hide them. Use our HTTP header viewer to check any site — including your own.

Redirect Headers and SEO

When a server returns 301 (permanent redirect) or 302 (temporary redirect), the Location header tells the browser where to go next. Search engines treat 301 and 302 differently: 301 passes link equity (PageRank) to the new URL, 302 does not. A 302 where a 301 should be leaks SEO value on every redirect. Check your redirect headers — especially after site migrations where redirect rules are configured in bulk and one wrong flag can affect hundreds of URLs. The Location header also reveals whether redirects are relative or absolute, whether they preserve or drop query strings, and whether redirect chains form (A → B → C — each hop adds latency and some browsers stop after a certain number).

For more in-depth analysis of specific security configurations, use our SSL Certificate Checker to inspect TLS configuration, and our HTTP Status Codes reference to understand response codes.