SEO & webmaster
Security Headers Check
An A to F grade that shows whether your site really protects its visitors.
HTTP security headers are your site’s first line of defense: they enforce encrypted connections, keep malicious scripts out and stop your pages from being loaded inside deceptive frames. Yet most websites ship without them — not because they’re hard to add, but because nobody checks. This tool requests your site, inspects the seven headers that matter — HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and COOP — and grades the result from A to F. Present headers are shown with their values; missing ones are called out so you know exactly what to add. Free and instant, no sign-up.
How does it work?
- Enter your site’s address (homepage or any other page).
- Click “Analyze” — the response headers are inspected.
- Review your grade and the list of present and missing headers.
- Add the missing headers to your server configuration, then test again.
Frequently asked questions
What do HTTP security headers actually do?
They are instructions your server sends to the browser: enforce HTTPS (HSTS), restrict which scripts may run (CSP), forbid embedding your site in a hostile iframe (X-Frame-Options), control what information leaks to other sites (Referrer-Policy), and more. Together they block the most common web attacks.
My site got a bad grade — has it been hacked?
No. A low grade means recommended protections are missing, not that the site is compromised. Think of it as a door without a deadbolt: nothing has happened yet, but the risk is higher and cheap to fix.
How do I add these headers?
They are set server-side: a few lines in your nginx or Apache config, a _headers file on Netlify, or rules in your CDN. HSTS and X-Content-Type-Options take minutes; CSP needs more care, since an over-strict policy can block your own scripts.
Do security headers affect SEO?
Indirectly, yes. Google favors HTTPS sites, and a secure site avoids the browser warnings that scare visitors away. Security reviews and procurement checklists also increasingly require them.