Security headers test — CSP, HSTS and your certificate

See how your server greets a browser. We count the six key security headers, grade the quality of your CSP rather than just its presence, verify the certificate and TLS version, hunt for mixed content and check cookie flags. Free, no sign-up, any domain.

What the security headers test covers

The six key headers — Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. We score the full set and name each missing or weakened one, with a value you can paste straight into your config.

Policy quality, not just presence — A CSP header on its own guarantees nothing. A policy carrying unsafe-inline in script-src, unsafe-eval, or a wildcard * permits exactly the attacks it was meant to stop. We also check for the integrity attribute on scripts loaded from third-party domains.

Certificate, TLS and mixed content — Whether the certificate is valid, trusted and issued for this hostname, how many days remain before expiry, which TLS version served the connection, and whether an HTTPS page pulls any resource over plain http://.

Cookies and hardening — Secure, HttpOnly and SameSite flags on cookies the server sets, cross-origin isolation headers (COOP, CORP, COEP), and a /.well-known/security.txt file giving researchers somewhere to report a vulnerability.

This grades hardening; it is not a penetration test. We read one HTTPS response and the served HTML — precisely what a browser evaluates on first contact. We do not probe cipher suites, walk the certificate chain to its root, or exercise the application itself. A full set of headers does not mean the site is secure; it means it is not missing the layer a browser can enforce. Weightings and thresholds are in the methodology.

What each header actually does

Strict-Transport-Security (HSTS) tells the browser to reach your domain over HTTPS only, for a stated period — even when someone clicks an old http:// link. That closes the window for intercepting the very first request on an untrusted network.

Content-Security-Policy (CSP) declares where scripts, styles and frames may be loaded from. It is the single most effective defence against XSS, and also the header most easily configured to look present while protecting nothing.

X-Frame-Options (or CSP's frame-ancestors) stops your page being embedded in someone else's frame — clickjacking, where an invisible interface is layered over the button a visitor believes they are clicking.

X-Content-Type-Options: nosniff forbids the browser from guessing a file's type against the server's declaration. Without it, an uploaded image can end up executed as a script.

Referrer-Policy limits how much of your URL leaks to third parties in the Referer header. It matters anywhere a path carries identifiers.

Permissions-Policy switches off APIs the page does not use — camera, microphone, geolocation — including for third-party content embedded in it.

The minimum worth starting from

1. Four headers that carry no risk These four can go on almost any site without testing. They do not change how the site behaves, and they close whole classes of attack.

X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

2. HSTS, once everything really is on HTTPS First confirm every asset and redirect works over HTTPS. Then enable HSTS — max-age cannot be withdrawn quickly, because browsers remember the declaration.

Strict-Transport-Security: max-age=31536000; includeSubDomains

3. Roll out CSP in report-only mode Content-Security-Policy-Report-Only applies the policy without blocking anything and reports what would have been blocked. Only when the reports are empty should you switch to the enforcing header name.

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'

4. Close the holes in a policy you already have If CSP is already deployed, look at script-src. unsafe-inline and unsafe-eval void the XSS protection. Sign inline scripts with a nonce or hash instead of opening the whole category.

script-src 'self' 'nonce-R4nd0mPerRequest'

Where these are configured

Headers come from the server or CDN, so the location depends on your stack: an add_header block in nginx, Header set in Apache, the headers array in vercel.json, a _headers file on Netlify, Transform Rules in Cloudflare, or application middleware. The fix is configuration — it needs no change to the site's code.

One trap worth remembering: in nginx, any add_header inside a nested location discards every header inherited from the level above. That is why a site can carry the full set on its home page and none at all on /api or on static files. The scan reports what actually arrived in the response.

Frequently asked questions

Do security headers affect Google rankings? Not directly — Google has never confirmed any of them as a ranking factor. Indirectly they do: HTTPS has been a lightweight signal since 2014, and a site showing a browser warning, or compromised and flagged as dangerous, loses traffic immediately regardless of position. They are also part of routine due diligence for business customers.

I have an SSL certificate. Isn't that enough? A certificate encrypts transport between browser and server, and that is all it does. It will not stop an injected script from running, your page being framed by someone else, or a session cookie being read by JavaScript. Headers handle those, and CSP is the important one.

What is mixed content and why does it matter? It is a resource loaded over http:// on a page served via https://. Browsers block active mixed content such as scripts and stylesheets outright, and flag passive content while removing the padlock. It is usually old images, third-party scripts or embeds left over from a pre-HTTPS migration.

Can enabling CSP break my site? Yes, which is why it is never deployed straight into enforcing mode. Use Content-Security-Policy-Report-Only: the policy is evaluated but blocks nothing, and reports show what would have been blocked. Switch to the enforcing header only once those reports are clean.

Is the test free, and do I need an account? The test is free and requires no login or email address. Security is one of the eight pillars in a full SEOMaster audit, and the third heaviest after on-page SEO and performance.

Is this site safe? Domain reputation check · Email authentication test · How we scan