Free · No sign-up required
HTTP security headers test
Enter a URL and we’ll check the security headers that protect browsers from attacks, plus your cookie settings, and give you a security grade. For missing headers, we provide ready-to-use code lines.
Which headers are checked?
Security headers aren’t a direct ranking factor, but hacked sites drop out of search results and browsers flag insecure sites with a warning.
- Strict-Transport-Security (HSTS): the site opens over HTTPS only
- Content-Security-Policy: which resources may load (XSS protection)
- X-Frame-Options or frame-ancestors: clickjacking protection
- X-Content-Type-Options, Referrer-Policy, Permissions-Policy
- Hidden server version, and Secure, HttpOnly and SameSite flags on cookies
Frequently asked questions
How is the grade calculated?
Each header is scored by importance, and cookie flags count too. 90 and above is A+, 75 and above A, 60 and above B, 45 and above C, 30 and above D, and anything lower is F.
Can adding a CSP break my site?
A misconfigured CSP can block some scripts. Test it first with the Content-Security-Policy-Report-Only header to spot problems, then enforce it.
Where do I add the headers?
You can add them in your server settings (nginx, Apache, .htaccess), your CDN (e.g. Cloudflare rules) or your platform’s security settings.
Other free tools
SSL & HTTPS checkCertificate expiry, HSTS and mixed content
Technology & CMS detectorWordPress, Shopify, Ticimax… and server details
DNS & email securitySPF, DMARC, MX and DNS records
SEO analysis80+ checks, category scores and prioritized recommendationsPopular
SEO site auditTechnical and on-page checks for up to 15 pagesPopular
AI visibility checkDo ChatGPT and Perplexity recommend you?Popular
See where your site stands in 20 seconds.
Find your technical issues and AI visibility gaps with a free analysis, then leave the fixing to AutoAiSeo.
- No card required
- 5-minute setup
- Cancel anytime