Check
View HTTP headers
Public pages only, one at a time
Free, up to 30 requests per 10 minutes per visitor.
Public only, entered by you
Handig Web only reads pages that anyone can see without logging in, and only the address you enter. It skips login pages.
No email addresses or phone numbers
Handig Web refuses to collect them. Links to mailto: and tel: are only counted, never shown or exported.
Copyright stays
Texts, tables and images belong to whoever made them. Use them to check or to quote with a source, not to copy.
One page at a time
No scraping of sites. Handig Web reads what you give: a page, a short list or the sitemap a site offers itself. It follows robots.txt and keeps the pace low.
How it works
View HTTP headers in three steps
Paste the address
Of a public page, with or without https://.
Follow the route
Handig Web shows every redirect with its code, up to the final address.
Read the grade
From A+ to F, with what each security header does and whether it is set well.
Questions
Good to know
Why can’t I see the value of cookies?
A cookie can carry a session. Handig Web only shows the name of each cookie the server sets, never the value, and never sends cookies itself.
How is the grade worked out?
Six points count: HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and protection against framing. Without https it is always F.
Does Handig Web read the page itself?
No. For this tool Handig Web requests the page, reads the headers and closes the connection before the content arrives.