Security Headers: Check & Grade Any Site A–F
Security headers are HTTP response headers that tell browsers to enforce HTTPS, limit which scripts run and block clickjacking. Enter a URL to check HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, get an A–F grade and copy a starting configuration.
We request the URL live and grade the headers your server actually returns; nothing is probed or attacked. Free, no signup. Updated Oct 24, 2026 by the AEOeye team.
Security Headers Checker: The 6 Headers That Matter
Six headers do most of the work. Each one closes a specific door:
| Header | Protects against | Docs |
|---|---|---|
| Strict-Transport-Security | Downgrades to insecure HTTP | MDN |
| Content-Security-Policy | Cross-site scripting, injected scripts | MDN |
| X-Frame-Options / frame-ancestors | Clickjacking in hidden frames | MDN |
| X-Content-Type-Options: nosniff | Browsers guessing file types | MDN |
| Referrer-Policy | Leaking full URLs to other sites | MDN |
| Permissions-Policy | Unwanted camera, mic, location access | — |
Security Headers Check: CSP, HSTS and X-Frame-Options
These three carry the most weight in the grade. HSTS and clickjacking protection are quick wins; CSP is the hardest, because a strict policy can break scripts. Start with Content-Security-Policy-Report-Only to see violations without blocking anything, then tighten.
How do real sites score?
Unevenly. In our October 2026 analysis of 315 big-brand homepages (dataset):
- 84.1% sent HSTS, 72.7% had clickjacking protection and 62.2% sent nosniff;
- only 53.7% had a Content-Security-Policy, 37.1% a Referrer-Policy and 15.9% a Permissions-Policy;
- just 21.9% had all five of the core headers, and 6% had none of them.
Do security headers help SEO?
Not directly as ranking signals, apart from HTTPS itself, which Google has used as a lightweight ranking signal since 2014. Their value is protecting visitors and your domain's reputation — a hijacked or defaced site loses rankings fast.
How is the grade calculated?
Points for each header that's present and sensible, deductions for weak values such as a short HSTS max-age or unsafe-url referrer policy. A is 90 or more, F is under 35. The nginx snippet is a starting point: test it on staging, especially the CSP.
For HSTS specifically — max-age, subdomains and preload eligibility — use the HSTS checker. To see every header your server sends, use the HTTP header checker.
One page checked. What about the rest of your site?
The free SEO audit crawls your site and scores ~90 checks across 7 areas — with the evidence and the fix for each problem.
FAQ
Which security headers should every website have?
+
At minimum Strict-Transport-Security, X-Content-Type-Options: nosniff, clickjacking protection with X-Frame-Options or CSP frame-ancestors, a Referrer-Policy, and a Content-Security-Policy suited to your scripts.
Will adding a Content-Security-Policy break my site?
+
A strict CSP can block scripts, styles or embeds you rely on. Deploy it first as Content-Security-Policy-Report-Only, fix the reported violations, then enforce it.
Is X-XSS-Protection still needed?
+
No. Modern browsers have removed the XSS filter it controlled, so the header does nothing useful today. A Content-Security-Policy is the real protection.
Sources
Related free tools
HSTS Checker
What is HSTS and is yours right? Check any site's Strict-Transport-Security header, max-age, includeSubDomains and preload eligibility, with fixes.
HTTP Header Checker
Free HTTP header checker: see every response header for a URL, with SEO-critical ones flagged — X-Robots-Tag, canonical Link, cache-control, HSTS.
Core Web Vitals Test
Free Core Web Vitals test: real-user LCP, INP and CLS from Chrome field data plus a mobile Lighthouse run — and the three fixes that matter most.
Redirect Checker
Free redirect checker: paste a URL to see every hop, status code (301/302/307/308), timing and loops — and whether the chain hurts SEO. No signup.