About the Security Headers Checker
Security headers are instructions your server sends with each response that tell browsers how to protect visitors. This security headers checker fetches a public URL and grades six key headers: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or the CSP frame-ancestors directive, Referrer-Policy and Permissions-Policy. It also flags headers like X-Powered-By that reveal server or framework versions.
Security headers are not a direct ranking factor, but they help protect against clickjacking, content sniffing and some script injection, and a hacked site can lose search visibility quickly. Add the simpler headers first, since they rarely break anything. Content-Security-Policy needs care: start in report-only mode and tighten it gradually so you do not block your own scripts.
How to use it
- Enter the URL of your site.
- Run the check to read the response headers and calculate a grade.
- Review missing headers and any that leak server details.
- Add headers in your server, CDN or hosting settings and re-test.
Frequently asked questions
Do security headers improve Google rankings?
There is no evidence that headers such as CSP or X-Frame-Options are ranking factors. HTTPS itself is a lightweight signal. Security headers matter because they reduce the risk of attacks that can lead to malware warnings, spam injection or a hacked-site label, all of which can seriously damage search traffic and trust.
Is HSTS safe to enable?
HSTS tells browsers to use only HTTPS for your domain for a set period. It is safe once every page and subdomain works over HTTPS. Start with a short max-age, confirm nothing breaks, then increase it. Be careful with includeSubDomains and preload, because they are hard to undo if a subdomain still needs HTTP.
Why should I remove X-Powered-By?
X-Powered-By and detailed Server headers announce the software and version you run, such as a PHP release. That information helps attackers look for known vulnerabilities. Removing or simplifying these headers costs nothing and does not affect visitors. It is not a substitute for keeping the software itself updated.