HTTP Headers Explained — Security, Caching, and How to Check Them

HTTP headers are the silent metadata of every web request and response. They control everything from caching to security to content negotiation — yet most developers only think about them when something breaks. This guide covers the most important headers and what they do.

Essential Security Headers

Content-Security-Policy (CSP)

Prevents cross-site scripting (XSS) by specifying which sources are allowed to load scripts, styles, and images:

Content-Security-Policy: default-src 'self'; script-src 'self' cdn.example.com

Strict-Transport-Security (HSTS)

Forces browsers to use HTTPS for future visits, even if the user types http://:

Strict-Transport-Security: max-age=31536000; includeSubDomains

X-Frame-Options

Prevents clickjacking by blocking your page from being embedded in iframes:

X-Frame-Options: SAMEORIGIN

X-Content-Type-Options

Prevents browsers from MIME-sniffing — interpreting files as a different type than declared:

X-Content-Type-Options: nosniff

Cache Control Headers

# Cache for 1 year (for versioned static assets)
Cache-Control: public, max-age=31536000, immutable

# Don't cache (for API responses or dynamic pages)
Cache-Control: no-store

# Cache but revalidate each time
Cache-Control: no-cache

How to Check Headers for Any URL

Use the EazyTools HTTP Header Checker to inspect all response headers for any publicly accessible URL — no browser devtools needed.