Skip to content
ThemesIonic — home

HTTP Header Checker

What headers decide

Headers are the instructions that travel with a page but never appear on it. They tell the browser whether to keep using HTTPS, whether the page may be framed, how long a copy may be reused, and which of several caches answered.

Most of what people debug as a caching bug or a mixed-content bug is a header saying something other than what they assumed.

The security headers, and what each one buys

  • Strict-Transport-Security. Once seen, the browser refuses plain HTTP for this host. It is what makes an HTTPS migration stick — see setting up SSL.
  • Content-Security-Policy. Limits where scripts, styles and frames may come from. The strongest single defence against injected script, and the one most likely to break a page if applied carelessly.
  • X-Content-Type-Options. Stops the browser second-guessing a declared file type.
  • X-Frame-Options. Controls framing, which is what clickjacking depends on.
  • Referrer-Policy. Decides how much of the current URL is handed to the next site.
  • Permissions-Policy. Switches off browser features the page has no use for.

Absent is not the same as broken. A small content site with no forms needs less than a shop. But absent should be a decision, not an accident — the wider list is in the WordPress security checklist.

Reading the caching headers

Cache-Control is the one that decides. max-age is how long a browser may reuse its copy; s-maxage overrides it for shared caches such as a CDN. Vary names the request headers that make a stored copy specific rather than shared — get it wrong and one visitor's page is served to another.

If an edit is not appearing, the header tells you which layer is holding it, which is the whole method in how to clear the WordPress cache.

Checking your own site

Test a page a logged-out visitor would see. Logged-in requests usually bypass the page cache entirely, so they show headers no real visitor receives — the single most common reason a caching problem looks invisible to the person who owns the site. The background is in how to check HTTP headers.