A header check is a review of HTTP response headers to determine how an application applies access rules. In web security, this often means examining headers such as CORS-related fields to see whether a browser will be allowed to expose a response to another origin. The check is useful because access control decisions can be encoded in a single line, and a small mistake can widen trust unexpectedly.
Header checks matter in both testing and defense. Security teams use them to verify that allowed origins are exact, that exceptions are not overly broad, and that behavior stays consistent across requests and edge cases. Attackers and bug bounty researchers use the same checks to spot misconfigurations where a browser may read data that should remain isolated. In practice, a good header check turns policy review into something repeatable and measurable.