HTTP Security Headers Explained

Headers describe how a response should be handled

HTTP headers are metadata sent with a website response. They can describe content type, caching, redirects, browser security rules, compression, server behavior, and cookies. Reading headers is often faster than guessing from the visible page.

Important headers

• Strict-Transport-Security: tells browsers to prefer HTTPS for future visits.
• Content-Security-Policy: limits where scripts, frames, images, and other resources can load from.
• X-Frame-Options: helps prevent unwanted framing on older browser setups.
• Cache-Control: controls whether browsers and proxies can store the response.
• Location: shows where a redirect sends the visitor.
• Set-Cookie: creates or updates cookies and should be reviewed for Secure, HttpOnly, and SameSite where appropriate.

How to troubleshoot with headers

If a page redirects unexpectedly, inspect Location and status code. If a change does not appear, check Cache-Control. If browser features break after a security update, review CSP. If login cookies behave strangely, check cookie attributes and domain scope.

Paste response headers into the HTTP Header Checker to highlight common security and caching signals.