HTTP Headers Checker

Most critical: X-Robots-Tag (server-side equivalent of <meta name="robots">, can deindex a page without anyone noticing). Then: Cache-Control and Vary (impact on crawl budget and CDNs), Link (canonical and hreflang served from the server), Content-Type and its charset (encoding), Last-Modified and ETag (conditional 304s). On the security side: HSTS, CSP, X-Content-Type-Options.

HSTS (Strict-Transport-Security) must be served on the HTTPS version. If the tool doesn't see it while you are on HTTPS, that's a real problem: your site does not instruct browsers to always use HTTPS on subsequent visits, exposing the user to SSL downgrade attacks on the first visit. Add Strict-Transport-Security: max-age=31536000; includeSubDomains; preload in your server or CDN config.

Three typical cases. First, it is served on the wrong URL, Google reads it on the canonical URL, not on variants. Second, it is placed on the OK response but Google fetches via a 301, check the redirect chain. Third, the targeted bot does not match, X-Robots-Tag: googlebot: noindex applies only to Googlebot, not Bingbot. Prefer X-Robots-Tag: noindex without prefix to target all bots.

In modern usage, Cache-Control takes priority, Expires is legacy HTTP/1.0 and ignored when Cache-Control is present. Useful SEO directives: public (allows CDN caching), max-age=N (duration in seconds), s-maxage=N (CDN override), stale-while-revalidate=N (serves the expired version while regenerating). Avoid no-cache and no-store on SEO pages, they force revalidation on every request.