Security headers checker
Enter an address to see which security headers the site sends, which are missing, and whether the server reveals software versions it doesn’t need to.
FAQ
Security headers checker questions
Do security headers affect SEO?
Not directly; they aren’t a ranking factor. HTTPS is a light ranking signal, and HSTS makes sure visitors always reach the https version. Mostly these headers protect your visitors from attacks like clickjacking and content injection.
Which security headers matter most?
Strict-Transport-Security (forces https), Content-Security-Policy (limits where scripts and other content can load from), X-Content-Type-Options: nosniff, a frame rule (X-Frame-Options or CSP frame-ancestors) against clickjacking, Referrer-Policy and Permissions-Policy.
How do I add security headers?
In your web server’s configuration (nginx, Apache), your hosting platform’s headers file (Netlify, Vercel, Cloudflare Pages _headers), or your CDN, for example Cloudflare’s Transform Rules. Add Content-Security-Policy carefully: test it in Report-Only mode first, because a strict policy can break scripts.
Should I add my site to the HSTS preload list?
Only once every subdomain works over https, because preloading is hard to undo. Start with a short max-age, raise it to at least a year, then add includeSubDomains and preload.
Check your whole site
The free site audit crawls every page and lists what stops them ranking: broken links, redirect chains, missing tags, blocked pages, with fixes.