Security Headers Checker
Free security headers checker — test HSTS, CSP, X-Frame-Options, Referrer-Policy and more on any URL, score them 0-100, detect version leaks and get ready-to-paste Nginx / Apache fixes.
How it works
- Enter a URL (e.g. example.com) — redirects are followed to the final page.
- All nine security headers are graded with weights, plus leakage and cookie-flag checks.
- Read the score and copy the ready-to-paste Nginx / Apache config for every missing or weak header.
Features
- Nine weighted checks: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP
- 0-100 security score with A-F grades
- Server / framework version leakage detection (Server, X-Powered-By…)
- Set-Cookie security flags: Secure, HttpOnly, SameSite
- Ready-to-paste Nginx and Apache fix configs for every weak header
FAQ
What are HTTP security headers?
Response headers like HSTS, CSP and X-Frame-Options tell browsers how to behave securely on your site. They defend against XSS, clickjacking, MIME sniffing and protocol downgrade attacks.
Do security headers affect SEO?
Indirectly, yes. Browsers and Google mark sites without HTTPS enforcement or with mixed content as "not secure", which hurts trust and conversions. A clean header profile also reduces hack risk that can get a site blacklisted.
How is the score calculated?
Nine headers are weighted by impact (CSP 20, HSTS/XCTO/XFO 15 each, Referrer-Policy & Permissions-Policy 10 each, COOP/COEP/CORP 5 each) for a 0-100 score. Weak values (e.g. short HSTS max-age, CSP with unsafe-inline) score partial credit.
Will adding these headers break my site?
Most are safe to add directly. For Content-Security-Policy, start in Report-Only mode and tighten gradually, because a too-strict CSP can block legitimate scripts. The generated config is a recommended baseline, not a drop-in guarantee.
Related tools
SEO Site AuditCrawl your site and get a full SEO audit report with prioritized fixes.Website AnalyzerFull on-page analysis: meta, headings, images and more.SEO CheckerInstant SEO report: meta tags, robots.txt, sitemap, SSL and WHOIS.Meta Tag AnalyzerInspect title, description, Open Graph and robots meta tags.
Want a complete site health report?
Run a free SEO check — page, HTTPS, robots.txt, sitemap, SSL and WHOIS in one report.
Try SEO Checker