Do security headers affect rankings?

Google hasn’t named them as a ranking factor. HTTPS is a lightweight ranking signal, and these headers protect your visitors, which is reason enough.

Treat it as a checklist, not a pass mark. A strict CSP takes work to roll out, so start with HSTS, nosniff and frame protection, which are one-line changes.

I use CSP frame-ancestors instead of X-Frame-Options

That’s the modern way, and browsers that support it are protected. We only look for the X-Frame-Options header, so it will show as missing.

Yes. Every tool is free with no signup.

Do you store what I enter?

Browser tools never leave your device. Live tools fetch the URL you enter and don’t save the result.

How is this different from the site audit?

This tool checks one thing in depth. The site audit checks everything at once and scores SEO, AI Search and Agent Readiness.

Tools / Crawling & indexing

Which security headers does this site send?

See the full HTTP response headers for any URL and check the six security headers browsers rely on.

Free, no signup.

URL

Example result: stripe.com · checked 2026-09-30

Security headers — 5/6 present

Strict-Transport-Security	✓ max-age=63072000; includeSubDomains; preload
Content-Security-Policy	✓ base-uri 'none'; child-src 'none'; connect-src https://c.inc
X-Frame-Options	✓ SAMEORIGIN
X-Content-Type-Options	✓ nosniff
Referrer-Policy	✓ no-referrer-when-downgrade
Permissions-Policy	✕ missing

Why it matters

HSTS keeps visitors on HTTPS

Strict-Transport-Security tells browsers to use HTTPS for your domain from then on, closing the gap an http link leaves.

CSP limits what can run

A Content-Security-Policy restricts which scripts, styles and frames a page may load, which blunts cross-site scripting.

Crawler directives live here too

X-Robots-Tag, Link and caching headers are part of the same response. The full list shows everything a crawler receives.

What it checks

Strict-Transport-Security

Whether browsers are told to always use HTTPS.

Content-Security-Policy

Whether a policy limits where scripts, styles and frames can load from.

Frame and type protection

X-Frame-Options against clickjacking, and X-Content-Type-Options: nosniff against MIME sniffing.

Referrer-Policy

How much of your URL is shared with the sites you link to.

Permissions-Policy

Which browser features, like camera, microphone and location, a page may use.

All response headers

The complete header list after redirects, including X-Robots-Tag, caching and CDN headers.

How it works

Enter a URL

A domain or page address. No install, nothing to add to your site.

We fetch it live

Our servers request the page read-only, the way a crawler would.

Read and fix

Get the results in seconds, with what each one means.

Questions

More in Crawling & indexing

Indexability CheckerFind out if a page can be indexed, and exactly what's blocking it.robots.txt CheckerFetch robots.txt and test any path against Googlebot and AI bots.XML Sitemap CheckerParse a sitemap or sitemap index, count URLs and list entries.

Check everything at once

The site audit checks your whole site and scores SEO, AI Search and Agent Readiness in about 30 seconds.

Audit my site