HTTP header check

What headers tell you

With every page a server sends headers: what kind of content follows, how long it may be cached, which server software answered. They explain many odd effects, such as a page that will not update or a download that opens in the browser.

Security headers tell the browser to be stricter: to use https only, not to guess content types, not to let other sites embed the page. A missing header is not a hole by itself, but each one closes a common line of attack.