Security headers checker
HTTP security headers protect visitors from clickjacking, content sniffing and protocol downgrade attacks. Check which ones your site sends, along with HTTPS, the HTTP redirect and mixed content, and get copy-paste values for the missing ones.
Free, no signup. Results in about 2 minutes, along with the rest of a full SEO audit of the page.
What the security headers checker looks at
Strict-Transport-Security
HSTS forces browsers to use HTTPS for your site, preventing downgrade attacks.
Content-Security-Policy
Controls which scripts, styles and frames can load, the main defence against cross-site scripting.
Clickjacking and sniffing
X-Frame-Options (or CSP frame-ancestors) and X-Content-Type-Options: nosniff.
Referrer-Policy, HTTPS and mixed content
Whether full URLs leak to other sites, HTTP redirects to HTTPS, and no resources load insecurely.
Issues it can find
Each one links to what it means and how to fix it.
Questions
What are HTTP security headers?
Response headers your server sends with each page that tell the browser how to behave: always use HTTPS (HSTS), which resources may load (CSP), whether the page can be framed (X-Frame-Options), and how much of the URL to share with other sites (Referrer-Policy).
Do security headers affect SEO?
Not directly as ranking factors, but HTTPS is a ranking signal, and headers like HSTS make it airtight. They also protect your visitors and your reputation: a hacked or spam-injected site loses rankings fast.
How do I add security headers?
Set them in your web server (Nginx add_header, Apache Header set), your CDN (Cloudflare Transform Rules, Netlify _headers, Vercel vercel.json) or your framework’s config. Start Content-Security-Policy in report-only mode so it can’t break your site.
Which security headers are most important?
Start with Strict-Transport-Security, X-Content-Type-Options: nosniff and X-Frame-Options: SAMEORIGIN, which are safe for almost every site. Then add a Referrer-Policy and work towards a Content-Security-Policy.