Hivex tools · WebsiteFree · No account

Headers of github.com.

Every response header a web address sends, with the security headers checked and explained.

Trygithub.com hivex.si stripe.com

https://github.com/

Checked 08:56:47 UTC · Fetched from Hivex's servers

Status: 200 OK
Server: github.com
Security headers: 5 of 6
Content type: text/html

Check: No Permissions-Policy. Embedded content may ask for the camera, microphone or location.
Note: Followed one redirect to https://github.com/; these are its headers.
Good: HSTS is set.
Good: Content Security Policy is set.
Good: X-Content-Type-Options is set.
Good: Referrer-Policy is set.
Good: Framing is restricted (X-Frame-Options or frame-ancestors), so other sites cannot embed the page to trick clicks.

18 response headers

Cookies left out

Response headers of https://github.com/
Header	Value
accept-ranges	bytes
cache-control	max-age=0, private, must-revalidate
connection	close
content-language

How it got there

01301 Moved Permanentlyhttp://github.com/→ https://github.com/20 ms
02200 OKhttps://github.com/38 ms

Looking up…

What response headers are.

Before any page content, a server sends headers: the status, the content type, how long browsers may cache the page, and rules the browser must follow. They are invisible on the page but decide a lot about speed and safety.

The security headers.

Strict-Transport-Security (HSTS): browsers use https:// only, even when someone types http://.
Content-Security-Policy: where scripts, styles and frames may come from, which stops most injected scripts.
X-Content-Type-Options: nosniff: browsers trust the declared file type instead of guessing.
X-Frame-Options or CSP frame-ancestors: who may show the page inside a frame, against clickjacking.
Referrer-Policy and Permissions-Policy: what the page shares with other sites, and which device features embedded content may ask for.

Where to set them.

Headers are set by the server, the hosting platform or a CDN in front of it: a config file, a dashboard rule, or the framework's settings. Add them one at a time and check the site after each, starting with nosniff and HSTS, which rarely break anything.

Questions people ask.

What are HTTP response headers?

Information a server sends before a page: the status, the content type, caching rules, and security rules the browser must follow.

Which security headers should a website send?

Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, a framing rule (X-Frame-Options or frame-ancestors), Referrer-Policy and Permissions-Policy.

How do I check the headers of a website?

Type the address. The checker follows any redirects and shows every header of the final page, with the security headers checked.

How do I add security headers?

In your server, hosting platform or CDN settings. Add them one at a time and test the site after each.

Hivex index

Short names, still free to register.

Starting something new? Hivex keeps a live index of short, brandable .si names nobody has claimed yet, each checked with the registry.

Browse free names

From code, or an AI assistant.

Hivex's free JSON API and MCP server check domains, DNS and registration records from your own code or from AI assistants that speak MCP. No key needed.

The API guide The MCP server OpenAPI schema

More Website tools

All free tools

Sources

By Hivex. Updated 10 October 2026. Addresses are fetched live from Hivex's servers; page contents are never read or stored.