HTTP Security Headers
Audits the security headers your server sends. Security is not a ranking factor on its own, but HTTPS, HSTS and mixed-content problems affect both crawling and trust.
- Sign-in requiredMembership is free
- Open on the Pro plan100 runs a day
- Saved to your historyReachable from your account
What does this tool look at?
Everything that decides whether Google can crawl and index your page: tags, redirects, robots, sitemaps and server responses.
- HSTS, CSP, X-Content-Type-Options, Referrer-Policy
- Whether the HTTPS redirect actually works
- Headers that leak your server and stack version
What this tool measures
Security headers are short instructions the server attaches to every response. They tell the browser things like “always come to this site over https”, “do not guess the file type”, “do not let another site frame me”. They do not change the page's content; they constrain how it is allowed to behave.
None of them is a direct ranking factor. But a “not secure” warning in the browser sends visitors back, mixed content breaks the page, and a domain that does not redirect to https serves the same content at two separate addresses. All three touch search performance.
The tool calls your domain once and audits six common headers. It also probes the http version of the site separately: does it really redirect to https? Finally it checks whether the server is leaking version information.
How to use it
- 1
Enter your domain
This is a site-wide measurement, not a per-page one. Headers are usually defined at the server or CDN level.
- 2
Start with the two red headers
HSTS and X-Content-Type-Options are marked critical. Both are one-line additions and break nothing.
- 3
Confirm the http → https redirect
Old links and hand-typed addresses still arrive over http. With no redirect, you effectively run two sites.
- 4
Leave CSP for last
Content-Security-Policy is the most powerful and the most dangerous header. Ship it in report-only mode first, then enforce.
When to use it
- As part of the technical checklist before a new site goes live.
- After a security review or a client question, to document the current state.
- After switching server or CDN, to confirm the headers travelled to the new environment.
- When the browser console shows mixed content warnings and you want to see where HSTS stands.
Reading the result
No HSTS
A visitor's first request can still go over http. With max-age=31536000 the browser goes straight to https for a year.
No X-Content-Type-Options
It should be nosniff. Letting the browser guess file types can lead to an uploaded file being executed as a script.
CSP undefined
Nothing limits where scripts on the page may come from. A compromised third-party script hits you directly.
No X-Frame-Options
Your page can be placed inside another site's frame. SAMEORIGIN closes off clickjacking.
Server version leaking
The Server and X-Powered-By headers announce which software and version you run. That is a ready-made map for an attacker.
Questions about the HTTP Security Headers
They are not direct ranking factors. HTTPS itself is a light ranking signal and Google has said so openly. The real effect is indirect: a visitor who sees a browser warning leaves, and a page broken by mixed content is judged poorly.
Yes, and it is the one header to treat carefully. For the max-age duration the browser will only reach your site over https; if your certificate expires or a subdomain lacks https, the site becomes unreachable. Start with a small max-age and raise it to a year once everything works.
Only if every subdomain you own already works over https. If a single one does not, leave it out: the moment you add it, that subdomain stops opening in every browser and undoing it means waiting out the max-age.
In the server configuration (Nginx, Apache), in the application layer, or from your CDN dashboard. On Next.js the headers section of next.config is the most practical place, since it applies them to every path in one go.
Use it alongside these
The other tools in the same category. Run them together and you see the whole picture.
The tool found the problem. Now for the fix
We run technical SEO, content and AI visibility work end to end. Let us review your site and come back with a clear list of what to do.
Monday – Saturday 09:00 – 18:00