Security Headers Checker
Enter a website and get a security grade from A+ to F. See which of the key headers are in place, how strong each one is, whether cookies are protected, and copy the exact config for Nginx, Apache, Cloudflare, Netlify, Vercel or Express.
- Graded from A+ to F
- Checks cookie flags too
- Config for 5 platforms
Want the whole picture? Run the Website Health Check, or read every header with the HTTP Header Viewer.
The headers that protect visitors and your site
Each header closes a specific kind of attack.
HSTS
Strict-Transport-Security makes browsers use only https, which stops downgrade and interception attacks on repeat visits.
Content-Security-Policy
Lists where scripts, styles and images may load from. It is the strongest defence against injected scripts and cross-site scripting.
Framing protection
X-Frame-Options or frame-ancestors stops other sites from hiding your page in a frame to trick clicks (clickjacking).
nosniff
X-Content-Type-Options: nosniff stops browsers guessing a file's type and running it as a script.
Referrer-Policy
Limits how much of your page address is shared with other sites when visitors click out.
Permissions-Policy
Switches off browser features you don't use, such as the camera, microphone and location.
What the grades mean
The grade reflects both what is present and how strong it is. Missing key headers cap the grade.
| Grade | Meaning | Typical state |
|---|---|---|
| A+ or A | Strong protection | HSTS for a year or more, a safe Content-Security-Policy, framing and nosniff, referrer and permissions policies, safe cookies. |
| B | Good, with gaps | Most headers are set, but the CSP is weak or a smaller header is missing. |
| C or D | Needs work | Several headers are missing, or HSTS is absent. |
| E or F | Weak or none | Almost no security headers, or the site isn't on https. |
How to check and fix security headers
Three steps from a grade to a fix.
Enter the site
Use the home page or any important page. The check also tests the http to https redirect.
Read the checks
Missing and weak items are listed with the reason and the fix.
Copy the config
Pick your server type, copy the lines into your config, deploy, and check again. Test a strict CSP in report-only mode first.
Adding headers without breaking the site
Most headers are safe to add straight away. A few need testing.
Safe to add now
X-Content-Type-Options, X-Frame-Options (SAMEORIGIN), Referrer-Policy and Permissions-Policy rarely break anything.
HSTS in steps
Start with a short max-age, check that every subdomain supports https, then raise it to a year.
CSP in report-only
Send Content-Security-Policy-Report-Only first and fix the reports, then switch to enforcing.
Cookie flags
Set Secure, HttpOnly and SameSite in the app or server settings, so session cookies can't be read by scripts.
Hide the version
Remove X-Powered-By and server version numbers so attackers can't pick known flaws.
Re-check after changes
A CDN, plugin or deploy can drop headers. Check again after each change.
What HTTP security headers are and what a checker tells you
HTTP security headers are instructions a server sends along with a page, telling the browser which protections to apply. Strict-Transport-Security makes the browser use only https. Content-Security-Policy limits where scripts, styles and images may load from. X-Frame-Options or frame-ancestors stops other sites from framing your page. X-Content-Type-Options: nosniff stops the browser guessing file types. Referrer-Policy and Permissions-Policy limit what is shared with other sites and which browser features can be used.
A security headers checker reads these headers from a public response and compares them with accepted practice, such as the OWASP HTTP Headers Cheat Sheet and MDN's Content-Security-Policy guide. This tool also checks the http to https redirect, the flags on cookies and headers that reveal server software. It is a passive check of public information. It does not probe for vulnerabilities, and a good grade does not mean a site is secure.
Headers are a layer of defence in depth. They reduce the damage a flaw can do, and they cost a few lines of server config, but they do not fix insecure code, weak passwords or outdated plugins. For SEO, they are not a ranking factor. Their value is indirect: a hacked or flagged site loses visitors and trust, and these headers make some common attacks harder.
When to check your security headers
Check after any change to the server, the CDN or the deployment setup, since headers are easy to lose.
After changing CDN or host
Moving to a new host, proxy or CDN can drop headers or set different ones. Check the live site, not just the config, to see what browsers actually receive.
Before launch or handover
Make header checks part of the pre-launch list. The tool writes the missing lines for Nginx, Apache, a _headers file, vercel.json and Express, so the fix is ready to paste.
To answer a client or vendor questionnaire
Security reviews often ask whether HSTS, a CSP and framing protection are in place. The grade and the list of gaps give you evidence to attach and items to close.
When reviewing logins and sessions
Check that session cookies carry Secure, HttpOnly and SameSite flags. Cookie names and flags are shown, but values are never returned.
To compare staging and production
Run both. Headers set by a CDN or reverse proxy in production are often missing on staging, and the reverse can also happen.
After a deploy or plugin update
Frameworks, plugins and server upgrades can add or overwrite headers. A quick re-check confirms the protections you set are still in place.
Security header mistakes and how to fix them
Most problems come from setting a strict header before checking what it will break.
Enabling HSTS for subdomains too early
What goes wrong: With includeSubDomains, every subdomain must work over https. A forgotten subdomain that only serves http becomes unreachable in browsers that have seen the policy, until the max-age runs out.
The fix: List your subdomains first, start with a short max-age, confirm everything works, then raise it to a year. Only add preload when you are sure.
A CSP full of unsafe-inline
What goes wrong: Allowing 'unsafe-inline' and 'unsafe-eval' for scripts, or using * as a source, removes most of the protection a CSP is meant to give against injected scripts.
The fix: Use nonces or hashes for inline scripts, list only the sources you actually use, and send the policy as Content-Security-Policy-Report-Only first to see what it would block.
Enforcing a CSP without testing
What goes wrong: A strict policy applied straight to production can block analytics, fonts, payment widgets or your own scripts, and the page looks broken.
The fix: Deploy in report-only mode, read the violation reports, adjust the policy, and switch to enforcing only when the reports are clean. Test the checkout and forms too.
Using ALLOW-FROM for framing
What goes wrong: X-Frame-Options: ALLOW-FROM is obsolete, and modern browsers ignore the header when they see it, so the page may end up with no framing protection at all.
The fix: Use DENY or SAMEORIGIN, or better, set frame-ancestors in your CSP. If you need to allow specific sites to embed the page, list them there.
Headers set in the wrong place
What goes wrong: In Nginx, an add_header in a location block means the parent level's headers are no longer inherited. On a CDN, a rule may apply only to some paths or file types.
The fix: Use the always parameter, repeat headers in every block that sets its own, and test several URL types: the home page, an inner page, an asset and an error page.
Keeping retired headers and version banners
What goes wrong: X-XSS-Protection: 1, Expect-CT and Public-Key-Pins are retired or deprecated, and X-Powered-By and version numbers in Server tell attackers what you run.
The fix: Remove the retired headers. Set X-XSS-Protection to 0 or leave it out, and strip X-Powered-By and version details in the framework or server settings.
Security header terms explained
- HSTS (HTTP Strict Transport Security)
- A header that tells the browser to use only https for a host for a set time, set with
max-age. It does not protect the very first visit unless the site is preloaded. - CSP (Content Security Policy)
- A header listing the sources a page may load scripts, styles, images and other resources from. It is mainly a defence against cross-site scripting and injected content.
- Report-only mode
- Sending the policy as
Content-Security-Policy-Report-Onlyso the browser reports violations without blocking anything. It lets you test a policy safely before enforcing it. - Clickjacking
- An attack that loads your page invisibly inside another site's frame and tricks visitors into clicking.
X-Frame-Optionsand CSPframe-ancestorsprevent it. - frame-ancestors
- A CSP directive that lists which origins may embed the page in a frame. MDN points to it for more comprehensive options than
X-Frame-Optionsoffers. - MIME sniffing and nosniff
- Sniffing is the browser guessing a file's type from its content.
X-Content-Type-Options: nosniffmakes it trust the declared type, so a file served with the wrong type is not run as a script or stylesheet. - Referrer-Policy
- A header controlling how much of the page URL is sent in the
Refererheader when a visitor follows a link or loads a resource. Modern browsers default tostrict-origin-when-cross-origin. - Permissions-Policy
- A header that allows or denies browser features such as the camera, microphone and geolocation for the page and its frames. An empty list, for example
camera=(), disables the feature.
Related tools, guides and services
Headers are one layer of site security. These check the others around them.
HTTP Header Viewer
Read every response header and each redirect hop, with an explanation of each one.
ToolSSL Certificate Checker
Check certificate expiry, issuer and names, and confirm that http redirects to https.
ToolWebsite Health Check
Combine security with speed, crawlability and on-page basics in one scored report.
ToolWordPress Security Checker
Run passive checks for exposed files, usernames, XML-RPC and outdated plugins on a WordPress site.
ServiceTechnical SEO service
Get server, redirect and rendering settings reviewed alongside the rest of your technical setup.
Built by
Madhav Kushwaha
SEO, AEO, GEO & Digital Marketing Consultant in Kathmandu, Nepal, and trainer at ODcrU Academy and TechAxis Institute. Security headers are among the cheapest wins in web security: a few lines of config, no code changes. I built this checker to grade them honestly, to say what each one does in plain words, and to hand over the config so the fix takes minutes.
Security Headers Checker: Frequently Asked Questions
More free SEO tools
Security starts with a valid certificate and good headers. These tools check each layer.