Security headers checker

Check the five response headers that harden a site in the browser, plus any mixed content loading over plain http from an https page.

Measuring rankings in

Runs the full audit on your live site. Your report opens in your dashboard.

What this checks

This reads five response headers from your live page and reports which are set: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy. HSTS is weighted highest because it is the one whose absence has a direct exploit. Alongside it we look for mixed content, resources requested over plain http from an https page, and forms that submit over http, which exposes whatever is typed into them.

Why it matters

These headers are not a ranking factor and they belong in a technical audit anyway, because they are cheap, they are set once at the edge, and their absence is a genuine risk rather than a theoretical one. Mixed content is the item with a visible consequence: browsers block it or mark the page as not secure, which costs trust on exactly the pages, checkout and contact forms, where trust is worth the most.

How to read a bad result

Missing HSTS is a warning; the three lower weighted headers are reported as information because sensible defaults now cover much of what they used to. Content-Security-Policy is the one that repays real thought and the one most likely to break a page if it is pasted in from an example, so introduce it in report only mode first. Insecure forms are the finding to act on today, ahead of any header.

Headers are cheap, they are set once at the edge, and they are the least likely thing on this site to be your problem. The audit is how you check that assumption instead of making it, in the same minute and against the same URL.

All 36 checks, free Plans

A failing result, and what it costs

A subscribe form on an https page. The page is secure; what the form does with what you type into it is not.

The form action is plain http, so the email address is submitted in clear text from a page displaying a padlock. Browsers now warn on this or block the submission outright, which on a contact or checkout form is a conversion problem before it is a security one. The missing HSTS header is the quieter half: without it, a first visit over http can be intercepted before the redirect to https ever happens, which is the one gap in this list with a direct exploit rather than a theoretical one.

<form action="http://example.com/subscribe" method="post">
  <input type="email" name="email" required>
  <button type="submit">Subscribe</button>
</form>

<!-- and the response headers -->
strict-transport-security: (not set)

How to fix it

Fix insecure form actions today.This is the finding with a visible consequence and a one-line fix. Grep the templates for action="http:// and for absolute http URLs in any asset.
Add Strict-Transport-Security once every subdomain serves https.One line at the edge. Start with a short max-age, confirm nothing broke, then raise it. Adding preload is a commitment that is hard to reverse.
Introduce Content-Security-Policy in report-only mode.It is the header that repays real thought and the one most likely to break a page if it is pasted from an example. Watch the reports for a week before enforcing.
Set the cheap ones and move on.X-Content-Type-Options: nosniff, X-Frame-Options or a frame-ancestors directive, and a sensible Referrer-Policy. Minutes at the edge, and then they are done.

Questions people ask

Do security headers affect SEO?

Not directly. HTTPS itself is a light ranking signal, and a browser warning on a page with a form has a much larger effect on conversion than any ranking change would.

Which header should I add first?

Strict-Transport-Security, once you are certain every subdomain serves https. It is one line at the edge and it closes the downgrade attack that the others do not touch.

What is mixed content?

An https page loading an image, script or stylesheet over plain http. Browsers block the dangerous kinds outright and flag the rest, so the page either breaks quietly or looks untrustworthy.