Free SEO tool
Security Headers Checker
This security headers checker requests a URL, follows its redirects and reads the final response. It checks Strict-Transport-Security, Content-Security-Policy, framing protection, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags Server and X-Powered-By values that disclose a version, and shows every raw header value next to the verdict of its audit rule.
How to Check Security Headers
Enter a URL and submit it: the checker reads the headers of the final response once and judges each one with the rules of a full audit.
- Enter the full address of the page, including https://.
- Select Submit. The checker requests the URL, follows any redirects and reads the headers of the final response.
- Read the verdicts: each rule shows Pass, Fail, To review, Not applicable or Not checked, with a message and the evidence it found.
- Compare the raw values in the protection and disclosure tables with the configuration of your web server or application.
- After you change the configuration, check the URL again, or run a full audit to see these results next to every other rule.
Security Headers Check Results Explained
Each security header gets one of five states from the same rules a full audit uses, shown next to the raw header value the response sent.
Pass
The header is present with a value that protects the page, or, for Server and X-Powered-By, it reveals no version number. Framing protection also passes when a Content-Security-Policy header sets frame-ancestors and X-Frame-Options is absent.
Fail
The header is missing or its value does not protect the page: an HSTS max-age that is 0 or missing, X-Content-Type-Options other than nosniff, a Referrer-Policy of unsafe-url, or a version number in Server or X-Powered-By. A Content-Security-Policy-Report-Only header alone still fails, because it only reports violations.
To Review
Only Permissions-Policy uses this state. A page that uses no camera, geolocation or other powerful browser feature may not need the header, so the result asks you to decide.
Not Applicable
HSTS is not applicable to a page served over plain HTTP, because browsers ignore the header there. The raw value is still listed when the response sends one.
Not Checked and Disabled
Not checked means the rule could not run on the response, and the message gives the reason. Disabled means the administrator switched the rule off, so it was not evaluated.
Raw Header Values
The protection and disclosure tables list each header exactly as the final response sent it, one value per line when the header is repeated. Not sent means the response did not include the header, and a policy declared in a meta element is listed after the headers.
HTTP Security Headers This Checker Tests
The checker tests six HTTP security headers that protect visitors and two headers that can disclose software versions.
Strict-Transport-Security (HSTS)
HSTS tells the browser to reach the host only over HTTPS for max-age seconds. The checker reads the first Strict-Transport-Security header, as browsers do, and requires a max-age greater than 0.
Content-Security-Policy
A Content Security Policy limits where scripts, styles, frames and other resources may load from. The rule accepts the policy as a response header or as a meta http-equiv element in the head.
X-Frame-Options and Frame-Ancestors
Both stop other sites from embedding the page in a frame. The rule accepts X-Frame-Options with DENY or SAMEORIGIN, or a frame-ancestors directive in a Content-Security-Policy response header; browsers ignore frame-ancestors in a meta policy.
X-Content-Type-Options
With the value nosniff, the browser uses the declared content type of a response instead of guessing it. Any other value fails.
Referrer-Policy
This policy limits how much of the page address the browser sends to other sites. The rule accepts the header or a meta referrer tag, which takes precedence, and fails unsafe-url, which sends the full URL everywhere.
Permissions-Policy
Permissions-Policy limits the browser features, such as the camera or geolocation, that the page and its frames may use. A missing header is a result to review, not a failure.
Server and X-Powered-By
These headers name the web server and the application platform. The checker fails them only when the value contains a version number, such as Apache/2.4.58 or PHP/8.2.12, and passes a bare product name.
Frequently Asked Questions About Security Headers
What Are Security Headers?
Security headers are HTTP response headers that tell the browser how to handle a page: which sources may load, whether other sites may frame it, how much referrer data to send and whether to always use HTTPS. The web server or the application sets them, not the page text. A Content-Security-Policy and a referrer policy can also be declared in a meta element.
Is This Security Headers Test Free?
Yes. A check creates no audit and does not use the audit allowance of a plan. Submissions are rate limited per visitor and per checked website, so a site is never flooded with requests.
Does a Missing Security Header Lower the SEO Score?
Yes. In a full audit every check that applies counts in the score, so each missing security header is one applicable check that did not pass. The audit score is the share of applicable checks that passed, and the results show where the response can be hardened.
Why Is HSTS Not Applicable on My Page?
Browsers ignore Strict-Transport-Security on a page served over plain HTTP, so the rule judges only https pages. Redirect the http address to https and send the header from the https response, then check the https URL.
Does the Checker Read Policies Declared in a Meta Element?
Yes, for Content-Security-Policy and the referrer policy, which browsers apply from a meta element in the head. A frame-ancestors directive in a meta policy does not count, because browsers ignore it there and the page can still be framed.
Popular tools