Free security headers checker
Check the headers your site sends to protect visitors: HSTS, Content-Security-Policy, clickjacking protection and more, with the exact line to add for anything missing. No signup.
We request the page once and read its response headers. Nothing is stored.
What security headers do
Every time a browser loads your page, your server sends a set of headers alongside it. A few of them are security instructions: always use HTTPS for this site, don't let other sites show this page in a hidden frame, don't guess what type a file is, only run scripts from these places. Visitors never see them, but they shut down whole categories of attack, and most take one line to add.
Reading your result
Strict-Transport-Security is red when missing, because without it a visitor on public Wi-Fi can be silently downgraded to an insecure connection. X-Content-Type-Options and clickjacking protection (X-Frame-Options or a CSP frame-ancestors rule) are amber: important, easy wins. Content-Security-Policy is amber when missing because it's the strongest protection but needs testing before rollout. Referrer-Policy and Permissions-Policy are good practice, and we also point out headers that advertise your server software and version.
Fixing them
Most headers can be added in your hosting control panel, your CDN (Cloudflare has toggles for several), a security plugin or the server config. Every item in the results says exactly what to add, so you can forward the page to your web person. For the bigger picture, see why HTTPS and security headers matter and our guide to a website security audit.
This is one check. Your site needs dozens.
The full AuditCrow audit runs this alongside speed, SEO, accessibility, trust and AI readiness, then tells you what to fix first, in plain English.
Common questions
Straight answers about what this check does, and doesn't do.
What are security headers?
Instructions your server sends with every page that tell browsers how to behave safely: only use HTTPS, don't let other sites frame the page, don't guess file types, and where scripts may load from. They're invisible to visitors but block whole classes of attack.
Which security headers matter most?
Strict-Transport-Security (HSTS) is the most important for most sites, followed by X-Content-Type-Options and clickjacking protection. Content-Security-Policy is the strongest but needs testing, so it's usually a job for your developer.
Do security headers affect SEO?
Not directly as a ranking factor. HTTPS is a light ranking signal, and the headers protect visitors and your reputation, which matters more. A hacked site loses rankings fast.
How do I add security headers?
Usually in your hosting control panel, CDN (such as Cloudflare), a security plugin, or the server config. Send your web person the results page; each item says exactly which header to add.
From the blog
All postsHTTPS and Security Headers: The Trust Signals Most Sites Get Wrong
The padlock icon is just the start. Here's what HTTPS and security headers actually protect - and why Google and visitors both care.
Read moreWhat Is a Website Security Audit? A Plain-English Guide
A website security audit checks your site for weaknesses an attacker could exploit. Here's what it covers, what you can check yourself, and when to call in a professional.
Read moreHow to Audit Your Website: The Technical SEO Checklist Every Small Business Should Run
What an SEO audit actually checks, how to run one yourself for free, and the ordered checklist of technical fundamentals that decide whether Google can find, crawl, and rank your site.
Read moreOther free tools
Quick checks for the things that most often go quietly wrong.