HTTP Headers Viewer

The most important: Strict-Transport-Security (HSTS) to enforce HTTPS; Content-Security-Policy (CSP) to prevent XSS; X-Frame-Options to prevent clickjacking; X-Content-Type-Options: nosniff to prevent MIME sniffing; Referrer-Policy to control referrer leakage; and Permissions-Policy to restrict browser features.

HSTS tells browsers to always use HTTPS for your domain. Preloading hardcodes your domain into browsers so they never make an HTTP request even on first visit. To qualify, serve HSTS with max-age >= 31536000, includeSubDomains, and the preload directive, then submit to the HSTS preload list.

Cache-Control: no-store means the response must not be stored anywhere — not in browser cache, not in proxy caches. It is the strongest cache-prevention directive, used for sensitive data. Compare to no-cache (can store but must revalidate) and private (can store in browser but not shared proxies).

MIME sniffing is when a browser ignores the declared Content-Type and guesses the file type. This can be exploited: an attacker uploads HTML disguised as a JPEG; the browser sniffs and renders it as HTML, enabling XSS. X-Content-Type-Options: nosniff tells the browser to trust only the declared Content-Type.