HTTP Header Checker

Every header a server sends back, explained in plain language, including the one that can keep a page out of search results without leaving a trace in the HTML.

The header that quietly deindexes pages

X-Robots-Tag does everything the robots meta tag does, from the response headers instead of the HTML. That makes it the hardest indexing problem to find by hand: you can read the entire page source, see no noindex anywhere, and still be excluded from every search engine.

It is typically set at the web server or CDN, often to exclude a staging environment, and it survives long after the reason for it has gone. If a page is inexplicably missing from search, the indexability checker tests this along with the other four causes.

Why there is no score

Plenty of header checkers finish with something like "Security: 76/100". We do not, because we would have to make the number up. Whether a missing Permissions-Policy matters depends on what your page does; a static article and a page handling payments are not comparable on one scale. This tool tells you what is set, what is not, and what each header does, and leaves the weighing to the person who knows the site.

Frequently asked questions

Which response header affects indexing?
X-Robots-Tag. It carries the same directives as the robots meta tag (noindex, nofollow, noarchive) but as a header, which makes it invisible in the page source. A noindex delivered this way survives every check made by viewing the HTML, and it is usually set at the server or CDN rather than in the application, often by someone who has since moved on.

Why is there no security score?
Because any number we put on it would be invented. Whether a missing Permissions-Policy matters depends entirely on what your page does, and compressing that into "76/100" implies a precision nobody has. The tool lists which headers are present, which are absent, and what each one does, and leaves the judgement to you.

What is the difference between this and the redirect checker?
The redirect checker is about the journey (every hop, its status and its timing. This is about the destination) the full header set of the response you actually land on, explained. If you want to know where a URL goes, use the redirect checker; if you want to know what the server said when you got there, use this.

Does a missing Strict-Transport-Security header hurt SEO?
Not directly. HTTPS itself is a lightweight ranking signal and has been for years; HSTS is a security improvement on top of it, protecting the first request from being downgraded. Worth setting, but not something to expect a ranking change from.

Why do the headers differ from what my browser shows?
Usually because a CDN or your own edge configuration adds or strips headers depending on who is asking. A request identifying itself as a crawler can genuinely receive a different response from one identifying as Chrome, which, when it happens by accident, is exactly the kind of problem worth finding.

Why is the Set-Cookie value hidden?
Because cookie values are frequently session tokens, and this tool renders its output on a public page. The header is listed so you know a cookie is being set; the value is not shown because there is no version of showing it that is safe.