HTTP Header & Security Header Checker
Enter a URL and SysGlass sends a single HTTP GET request, then shows you the exact response: status code, HTTP protocol version, response time, and every response header the server sent. It also checks for five key security headers — HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy — and warns you about any that are missing or about error status codes.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Status code and status line returned by the server (e.g. 200 OK, 301, 404, 500)
- HTTP protocol version of the response (e.g. HTTP/1.1, HTTP/2.0)
- Response time in milliseconds, measured from request sent to response received
- The full list of response headers, sorted alphabetically
- Presence of Strict-Transport-Security (HSTS)
- Presence of Content-Security-Policy (CSP)
- Presence of X-Content-Type-Options
- Presence of X-Frame-Options
- Presence of Referrer-Policy
- Flags any of those five security headers that are missing, with a fix suggestion to add them
How to read the result
- Pass: the status code is under 400 and all five tracked security headers are present. The summary reads like "HTTP 200 over HTTP/2.0 in 142 ms."
- Warning: either the status code is in the 400–499 range (client error such as 401, 403, 404), or one or more of the five security headers are missing. The summary names how many headers are missing.
- Fail: the status code is 500 or higher (server error), shown as "Server error: HTTP 5xx."
- The result lists Status, Proto, and Time first, then every response header in alphabetical order so you can scan the raw headers directly.
- When security headers are missing, a finding lists exactly which ones, plus a fix that tells you to set them to harden the site.
- Redirects are not followed: if you test a URL that returns a 301/302, you see that redirect response and its Location header, not the final page. Test the final HTTPS URL to inspect its headers.
Frequently asked questions
Which security headers does this tool check for?
It checks for five response headers: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, and Referrer-Policy. If any are missing, it lists them and suggests adding them. It still shows every other header the server returned, even ones it does not specifically grade.
Why does it warn even though my site returns 200 OK?
A 2xx or 3xx status passes on its own, but the tool also warns when any of the five tracked security headers are absent. So a perfectly reachable site can still get a warning like "HTTP 200, but 2 security header(s) missing." The finding tells you exactly which headers to add.
Does the checker follow redirects?
No. It returns the first response as-is, so testing a URL that redirects (301/302) shows the redirect status and its Location header rather than the destination page. To inspect the headers of the final page, enter that final URL directly.
Do I have to type https:// in front of the URL?
No. If you enter a host with no scheme, the tool automatically prepends https://. You can also explicitly enter http:// to inspect the plain-HTTP response (useful for confirming an HTTP-to-HTTPS redirect).
What exactly does the response time measure?
It measures the time from when the request is sent to when the response is received, in milliseconds, as seen from the SysGlass server. It is a single-request timing for header retrieval, not a full page-load or multi-sample benchmark, so treat it as an indicator rather than a precise latency metric.
How is this different from a tool like securityheaders.com?
It surfaces the raw HTTP response — status, protocol, timing, and the complete header list — and flags missing security headers with a pass/warn/fail verdict. It does not assign a letter grade or score; it reports presence or absence of the five headers and warns on error status codes so you can act on the actual data.
Is the tool free, and does it store my data?
Yes, it is a free public tool. It performs a one-off GET request to the URL you enter and returns the response; it is built for quick diagnostics, not logging or tracking the sites you check.