Security Headers Checker
Grade a site’s HTTP security headers (CSP, HSTS, X-Frame-Options and more).
About the Security Headers Checker
Security headers are instructions your server sends with every page that tell browsers how to protect visitors: force HTTPS, block clickjacking, prevent MIME-type sniffing, control referrer data and restrict which scripts may run. They cost nothing in performance and close off whole classes of attacks.
This checker requests your page, grades the six most important headers and shows an example value for any that are missing. Content-Security-Policy is the most powerful and the most complex – start in report-only mode (Content-Security-Policy-Report-Only) and tighten it gradually.
Frequently asked questions
Do security headers affect SEO?
Not directly. They protect your visitors and your site’s reputation – a hacked site injected with spam can be devastating for rankings.
How do I add security headers?
In Apache .htaccess with “Header set …”, in Nginx with add_header, through your CDN (Cloudflare Transform Rules), or in your application code.
Is X-XSS-Protection still needed?
No. Modern browsers have removed the XSS auditor it controlled. Use a Content-Security-Policy instead.