How to Check HTTP Security Headers on a Live Site

Checking HTTP security headers means reading the response headers your live origin (or CDN) actually sends, then judging whether HSTS, CSP, framing controls, and related policies are present and sane. The configuration in a repo does not count until it appears on the public hostname.

This guide shows three verification methods, what to look for, and how PatchPings turns the same checks into a graded security scan. For what each header does, start with What are HTTP security headers?.

Method 1: Browser DevTools

1. 1Open the site in a private window to avoid extension noise.
2. 2Open Network, reload, and select the main document request.
3. 3Inspect Response Headers for Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or CSP frame-ancestors, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy.
4. 4Repeat on a secondary route (login or app shell) in case headers differ by path.

Method 2: Command-line fetch

curl -sI https://yourdomain.com | findstr /I "strict content-security x-frame referrer permissions cross-origin x-content"

Follow redirects intentionally. Check both apex and www if both serve traffic. A header on one hostname does not protect the other.

Method 3: Automated scanner

Manual checks are easy to skip after deploys. An automated scanner requests the live URL, grades each header category, and highlights missing or weak values. PatchPings does this as part of a broader audit that also covers TLS and DNS health, then can suggest configuration snippets for common servers.

A practical checklist

• HSTS present with a sensible max-age (and preload only when ready).
• CSP present (report-only first if you are still tuning).
• Framing blocked via X-Frame-Options and/or frame-ancestors.
• `X-Content-Type-Options: nosniff` set.
• Referrer-Policy and Permissions-Policy set deliberately.
• COOP considered if you care about window isolation.

After you find gaps

Fix headers at the edge or origin that terminates TLS, redeploy, and re-check. Read How to read your security scan report so you prioritise framing and HSTS issues ahead of cosmetic warnings. Deep CSP work continues in the CSP setup guide and CSP nonce guide.

Header checks are only useful when they become a habit. Add a scan to your release checklist, keep policies in code review, and treat a missing header like a failed test rather than a backlog nicety.