Headers of stripe.com.
Every response header a web address sends, with the security headers checked and explained.
Looking up…
What response headers are.
Before any page content, a server sends headers: the status, the content type, how long browsers may cache the page, and rules the browser must follow. They are invisible on the page but decide a lot about speed and safety.
The security headers.
Strict-Transport-Security(HSTS): browsers use https:// only, even when someone types http://.Content-Security-Policy: where scripts, styles and frames may come from, which stops most injected scripts.X-Content-Type-Options: nosniff: browsers trust the declared file type instead of guessing.X-Frame-Optionsor CSPframe-ancestors: who may show the page inside a frame, against clickjacking.Referrer-PolicyandPermissions-Policy: what the page shares with other sites, and which device features embedded content may ask for.
Where to set them.
Headers are set by the server, the hosting platform or a CDN in front of it: a config file, a dashboard rule, or the framework's settings. Add them one at a time and check the site after each, starting with nosniff and HSTS, which rarely break anything.
Questions people ask.
What are HTTP response headers?
Information a server sends before a page: the status, the content type, caching rules, and security rules the browser must follow.
Which security headers should a website send?
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, a framing rule (X-Frame-Options or frame-ancestors), Referrer-Policy and Permissions-Policy.
How do I check the headers of a website?
Type the address. The checker follows any redirects and shows every header of the final page, with the security headers checked.
How do I add security headers?
In your server, hosting platform or CDN settings. Add them one at a time and test the site after each.
Hivex index
Short names, still free to register.
Starting something new? Hivex keeps a live index of short, brandable .si names nobody has claimed yet, each checked with the registry.
From code, or an AI assistant.
Hivex's free JSON API and MCP server check domains, DNS and registration records from your own code or from AI assistants that speak MCP. No key needed.
More Website tools
- Redirect checkerEvery hop of a URL: status code, target and time.
- Security headers checkerA grade for HSTS, CSP, framing and cookies, with fixes.
- SSL checkerTrust, expiry, the chain and TLS versions of any site.
- Open Graph checkerHow a link looks when shared, with the tags checked.
- Is it down?Down for everyone or just you, and where it fails.
- robots.txt testerGoogle, Bing and AI crawlers: allowed or blocked, and why.
- Sitemap checkerLimits, dates and hosts checked, a sample requested live.
- Who hosts this websiteWeb host, CDN, DNS host, mail provider and registrar.
- Tech stack checkerCMS, framework, hosting and trackers of any site.
- Domain checkerIs a name free to register? Checked live on any extension.
Sources
By Hivex. Updated 10 October 2026. Addresses are fetched live from Hivex's servers; page contents are never read or stored.