HTTP header checker

What response headers are

Before a server sends a page it sends a few lines about it: the status code, how long the page may be kept, whether it is compressed, and sometimes instructions for search engines and browsers. Visitors never see them, which is why a mistake in them can sit unnoticed for months.

The ones that matter for search

• Status. 200 is a page; 301 and 308 are permanent moves; 404 and 410 mean gone; 5xx means the server failed.
• X-Robots-Tag. A robots directive sent as a header. Google reads noindex here exactly as it reads the robots meta tag, so a stray header can keep a page out of search while the HTML looks fine (Google: robots meta tag and X-Robots-Tag).
• Compression. gzip, Brotli or zstd make the HTML a fraction of its size on the wire. Usually one setting in the server or CDN.
• Caching. Cache-Control, ETag and Last-Modified let a browser keep or quickly re-check a page instead of downloading it again.

The security headers — not ranking factors

Strict-Transport-Security, X-Content-Type-Options and the framing controls (X-Frame-Options or a Content-Security-Policy frame-ancestors) protect visitors. They are security good practice from the browser makers and security community, not something Google says it ranks pages on, and we label them that way. We judge them by the same rules as our audit's three security checks.

Next: follow the redirects, or check the HTTPS certificate.