HTTP headers checker

What you get back from the check

The tool calls Tenium's check service, which makes a GET request with the Tenium-Monitor/1.0 user agent, follows up to five redirects and reports the final response: status code, total time, resolved IP, certificate days left and the response headers (up to 40, each shortened to 300 characters). Two consequences are worth remembering. The headers belong to the last response, so the HSTS or cache headers of the http to https redirect hop are not shown. And because the request comes from a data centre as a bot, a CDN may answer with different headers than it sends to a browser.

When headers do not appear, the tool falls back to the curl command that prints them from your own machine: curl -sI https://example.com. HEAD is faster, but a few frameworks treat HEAD and GET differently, so use curl -s -D - -o /dev/null for a GET with headers.

Caching headers, read as a story

Cache-Control: public, max-age=31536000, immutable is right for fingerprinted assets such as app.3f9a1c.js, because the filename changes whenever the content does. For HTML it is usually wrong; no-cache (store, but revalidate every time) or a short max-age of 60 to 300 seconds is safer. no-store keeps a response out of every cache and belongs on pages with personal data. s-maxage targets shared caches such as a CDN separately from browsers.

Age tells you how many seconds a cached copy has lived. CF-Cache-Status: HIT, X-Cache: Hit from cloudfront and a rising Age mean the CDN answered; MISS or DYNAMIC means your origin did the work. A Vary: Cookie header on a public page will quietly make most requests uncacheable.

Security headers and sensible values

The values below are conventional starting points rather than a complete policy:

• Strict-Transport-Security: max-age=31536000; includeSubDomains. Add preload only when every subdomain really is https, because removal from the preload list takes months.
• Content-Security-Policy: start in Content-Security-Policy-Report-Only mode and read the reports before enforcing. A default-src 'self' policy will break inline scripts and third-party tags the first day.
• X-Content-Type-Options: nosniff, stopping the browser from guessing a type for a script or stylesheet.
• Referrer-Policy: strict-origin-when-cross-origin, the default in modern browsers, but set explicitly it removes ambiguity.
• Frame protection: frame-ancestors in the CSP supersedes X-Frame-Options, though sending X-Frame-Options: SAMEORIGIN does no harm for older clients.
• Set-Cookie: session cookies should carry Secure; HttpOnly; SameSite=Lax at least.

Headers that diagnose problems

Location shows where a redirect goes and the status shows how permanent it is: 301 and 308 are cached by browsers, 302 and 307 are not. Retry-After accompanies a 503 or 429. WWW-Authenticate on a 401 names the expected scheme. Server and X-Powered-By reveal software versions and are better removed. cf-ray, x-amz-cf-id and x-served-by name the CDN that handled the request, which is what a support ticket asks for.

From one look to a standing check

Headers drift whenever someone changes a CDN rule or a plugin. A monitor on the page records the status and timing at every interval, and you can pair it with a keyword check, which is included on every plan, to confirm real content is served. When a WAF blocks the checker, custom request headers on Pro let you send a secret value that your firewall matches. See website monitoring and the guide to allow-listing in Cloudflare.