SEO tools
HTTP Headers Checker: Security, Caching and Compression
Requests the URL you enter and reports what the server sends back in its headers — the security headers present, the caching policy, whether the response is compressed, and which HTTP version was negotiated.
What this headers checker reports
Headers are invisible in a browser window and easy to lose in a deploy. A CDN rule, a framework default, or a proxy in front of the origin can each add, strip or override them without anything on the page changing.
- Security headers, including HSTS, X-Content-Type-Options and the frame and referrer policies.
- Cache-Control, and whether the policy allows anything to be cached at all.
- Content-Encoding, showing whether the response is served with gzip or brotli.
- The negotiated HTTP version — HTTP/1.1, HTTP/2 or HTTP/3.
Which headers affect search, and which do not
Only X-Robots-Tag changes indexing directly, and it is the one people miss most often precisely because it never appears in the page source. The rest matter through performance and reliability rather than as ranking inputs.
| Header | Direct SEO effect | Why it still matters |
|---|---|---|
| X-Robots-Tag | Yes — controls indexing | A noindex here is invisible in the HTML |
| Cache-Control | Indirect | Drives repeat-visit speed and origin load |
| Content-Encoding | Indirect | Smaller transfers improve LCP |
| HSTS | No | Removes a redirect hop to HTTPS |
| X-Content-Type-Options | No | Security hardening, not ranking |
| Content-Security-Policy | No | Can break rendering if misconfigured |
Common header problems
The last one is the most damaging and the hardest to spot, because the HTML looks perfectly indexable. For the directive itself see noindex vs robots.txt , for the caching policy see the Cache-Control header , and for the security set see security headers .
- Cache-Control: no-store on static assets, so returning visitors re-download everything.
- A long max-age on HTML, so content updates are invisible to returning visitors.
- No compression on text responses, inflating transfer size several times over.
- A Content-Security-Policy that blocks the scripts the page needs to render.
- An X-Robots-Tag noindex left over from a staging environment.
- Do security headers improve rankings?
- No. They harden the site against attacks and are worth having, but Google does not treat them as ranking signals. The exception is X-Robots-Tag, which controls indexing outright.
- What Cache-Control should HTML use?
- A short max-age, or no-cache with validation, so content updates reach returning visitors. Long immutable caching belongs on fingerprinted static assets, not on HTML.
Other tools
Fetches the robots.txt file for the host you enter, reports whether it exists and whether it blocks every crawler, and reads the page-level robots directives alongside it.
Looks for the sitemap the way a crawler does — the robots.txt declaration first, then the conventional locations — then confirms it parses as XML and counts the URLs inside it.
Reads the canonical URL a page declares, then fetches that URL to confirm it resolves, is not redirected, and is not noindexed — the three ways a canonical silently becomes inert.
Parses the structured data on the page you enter, lists the schema.org types it finds, and flags blocks that fail to parse or are missing the properties their type requires.
Follows the URL you enter through every hop, reporting the status code at each step and the final destination — the detail a browser hides once the address bar settles.
Fetches the page you enter, takes a sample of the internal links it points at, and requests each one — reporting the status code that comes back instead of the colour of the link.
Checks every signal that decides whether a page is allowed into the index — the status code, robots.txt access, meta robots, the X-Robots-Tag header, and the canonical.
Queries the live DNS for the domain you enter and reports the records it publishes: the addresses it resolves to, where its mail goes, and whether the TXT records email authentication depends on are present.
Queries the registry over RDAP — the structured successor to classic WHOIS — and reports when the domain was registered, how old it is now, who the registrar is, and when the registration lapses.
Enter a domain to find when it was registered, how old it is today, when it expires, and which registrar holds it. Domain age is context for a diagnosis, not a Google ranking factor.
Opens a TLS connection to the host you enter and reports the certificate it presents — the issuer, the validity window, the days remaining, and the negotiated protocol version.