ToolsWeb & certificates

HTTP security headers

See the headers a web page sends, what each one protects against, and what to change. Redirects are followed one step at a time, and the grade shows its working.

Headers parsed and graded in your browser
Fetched via abbott.cloud, one request per redirect

Check

How this works

Your browser checks the address, then asks abbott.cloud/api/headers to fetch it. Browsers can't read another site's headers themselves.
The Worker makes one GET request to that address from Cloudflare's network, with the user agent abbott.cloud-header-check/1.0 (+https://abbott.cloud/tools/headers). It returns the status and headers, cancels the body unread, and doesn't follow redirects.
If the answer is a redirect, this page works out the next address from its Location header and asks again: one request per step, up to 10. The request log below shows each one. A redirect with two different Location headers isn't followed, because browsers refuse it.
This page parses every header, explains it and works out the grade, all on your device. The scoring table is shown with the results.

What's kept: nothing. The web address you check goes in this page's own address so you can share the result, but it isn't stored. The website sees the request come from Cloudflare's network, not from your IP address.

Limitations:

Sites can answer differently for other browsers, countries or signed-in visitors, and some block automated requests like this one.
Only response headers are read, never the body, so policies set in a page's <meta http-equiv> tags aren't seen.
No cookies or Origin header are sent, so CORS answers and personalised responses may differ.
Only public domain names on the standard ports (80 and 443) can be checked.
Telling sites apart, for a cookie's Domain attribute and for redirects to another domain, uses a short built-in list of shared suffixes such as com and co.uk, not the full Public Suffix List.
For very long headers, the page lists the first 20 notes about each one, the first 10 policies of each kind and the first 100 rows of each table. Raw headers shows the values as received.
To protect the sites being checked, abbott.cloud allows a limited number of requests a minute from each visitor and to each website. Each step in a redirect chain counts as one.

Code: headers.js (this page), lib/headers.js (parsing, checks and scoring), net.js (requests).