Security Headers Checker
Scan a site's HTTP security headers and get an A+ to F grade: HSTS, Content-Security-Policy, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy and cookies.
Something not working, or missing a feature? Send feedback
About the Security Headers Checker
The Security Headers Checker requests a page like a browser and grades the HTTP headers that protect its visitors, from A+ to F. It checks Strict-Transport-Security (HSTS), Content-Security-Policy and its weak spots, clickjacking protection (X-Frame-Options or frame-ancestors), X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It also flags software versions leaked in headers, cookies without Secure, HttpOnly or SameSite, and a missing HTTP-to-HTTPS redirect.
Our server requests the URLs you enter, like a crawler: it reads the response without running the page's scripts, and the analysis runs in your browser. The URLs and results are not stored.
How to use the Security Headers Checker
- Enter the URL; http:// addresses also show whether they redirect to HTTPS.
- Read the grade, then the failed checks with the exact header to add.
- Add the headers in your web server, CDN or framework config and re-scan.
- Roll out a Content-Security-Policy in report-only mode first, then enforce it.
Works well with the Security Headers Checker
- SSL Checker: check the HTTPS certificate and TLS version.
- Redirect Checker: follow the HTTP to HTTPS redirect chain.
- Website Technology Checker: see which server and CDN send the headers.
Frequently asked questions
Do security headers affect SEO?
Not directly; Google does not rank by them. HTTPS is a light ranking signal, and the headers protect visitors from attacks that could get a site hacked, injected with spam links or flagged by Safe Browsing, which does hurt search traffic.
What is the easiest way to get to A?
Add HSTS (max-age=31536000; includeSubDomains), X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, X-Frame-Options: SAMEORIGIN and a Permissions-Policy. Those five are safe for almost every site. CSP takes more care because it can block your own scripts.
Should I still send X-XSS-Protection?
No. Browsers removed the XSS filter it controlled, and the header could itself be abused. Send 0 or drop it, and use a Content-Security-Policy instead.
Related tools
Website SEO Checker
Check any page for on-page SEO problems: title, meta description, headings, canonical, robots.txt, noindex, structured data, alt text, HTTPS and speed, with a score.
Broken Link Checker
Find broken links on any web page: every internal and external link (and optionally image) is checked for 404s, server errors, timeouts and redirects. Export a CSV.
Redirect Checker
Check the HTTP status code and full redirect chain of up to 100 URLs: 301, 302, 404 and 5xx, response headers, loops and HTTPS downgrades, with fixes and CSV.
HTTP Status Checker
Check the HTTP status code of up to 100 URLs: 200, 301, 404, 500 and more, with what each means for SEO and a searchable list of every status code.
AdSense Readiness Checker
Check if your site is ready for Google AdSense: privacy policy, About and Contact pages, ads.txt, crawler access, thin pages, content risks and consent, before you apply.
Site Audit Tool
Crawl your website (up to 100 pages) and find broken pages, duplicate titles and descriptions, missing H1s, redirects, noindex, thin and slow pages. Export a CSV.