Security Headers Checker

A security headers checker looks for the response headers that harden a site against common attacks, such as Strict-Transport-Security and Content-Security-Policy, and reports which are missing. Security is not a direct ranking factor but protects users and trust.

This tool fetches the address you enter once, from our server, and reports what a crawler would receive. The URL is not stored; only a short-lived rate-limit counter is kept. Results show the page at the moment of the check and can differ from what a logged-in browser or a bot with different headers sees.

How to read the result and act on it

Review which of the common headers are present: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or frame-ancestors, Referrer-Policy and Permissions-Policy. Start with the low-risk ones. HSTS is valuable once the whole site works on HTTPS, X-Content-Type-Options: nosniff rarely causes issues, and Referrer-Policy is simple to set. Content-Security-Policy gives the most protection but needs careful tuning, so begin in report-only mode and watch for blocked resources. Add headers at the server, CDN or application level, then recheck. Keep notes of what you changed so any breakage can be traced and reversed quickly. Recheck other pages too, such as the checkout or login, because some applications set headers differently on each route.

Common mistakes to avoid

The biggest risk is switching on a strict Content-Security-Policy in production without testing, which can block analytics, fonts, payment widgets or inline scripts. Setting a very long HSTS max-age with includeSubDomains before every subdomain supports HTTPS can lock visitors out. Duplicated headers from both the application and the CDN may produce conflicting values. Do not copy a policy from another site without checking your own resources. Also avoid treating a perfect score as the goal; a header that fits your site matters more than one that merely appears. These headers protect users and trust, and they are not a direct ranking boost.

Which security headers should every site have?

Strict-Transport-Security, X-Content-Type-Options, a frame protection policy, Referrer-Policy and, where practical, Content-Security-Policy.

Do security headers improve rankings?

Not directly. HTTPS is a lightweight signal, and secure sites avoid trust-damaging incidents.

How do I add security headers in WordPress?

Add them through your web server config, a CDN rule or a reputable security plugin that sets headers. Start with X-Content-Type-Options, Referrer-Policy and HSTS, then test pages thoroughly before enabling a Content-Security-Policy. Check the result afterwards with a security headers checker to confirm they are being sent on every page.

What is HSTS and when should I enable it?

HSTS tells browsers to use HTTPS only for your domain for a set period. Enable it after the whole site, including subdomains you cover, works correctly on HTTPS, and start with a short max-age before extending it. Test it on a staging copy first if you can.

• HTTP Header Checker: View the response headers of a URL: status, server, cache, content type and more.
• HTTPS Redirect Checker: Check that http:// and www variants of a site redirect to one secure canonical address.
• Server Response Time Checker: Measure time to first byte and total download time for a URL from our server.

Browse all 41 free technical seo tools, or see the full free SEO toolbox. If you would rather have this handled for you, take a look at our technical SEO services and the results from real projects.