What are HTTP security headers?

HTTP security headers are response headers that tell browsers how to protect your site against common attacks — clickjacking, MIME sniffing, XSS, and protocol downgrade. Key headers include Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

Why do security headers matter for SEO and trust?

Browsers and crawlers treat HTTPS plus modern security headers as a trust signal. Missing HSTS or CSP can leave residual mixed-content and XSS risk that hurts user trust, bounce rate, and how AI systems evaluate whether your pages are reliable enough to cite.

What does an A+ security headers grade mean?

An A+ means every key security header is present and well configured — strong HSTS max-age, a meaningful CSP, clickjacking protection, nosniff, a sensible Referrer-Policy, and a Permissions-Policy. Lower grades mean one or more headers are missing or weakly set.

How do I fix a missing Strict-Transport-Security header?

Serve Strict-Transport-Security with a max-age of at least 15552000 (six months), ideally with includeSubDomains once all subdomains support HTTPS. Most CDNs and reverse proxies (Cloudflare, nginx, Caddy) can add it with a single config line.

Can I embed my security headers grade on my site?

Yes. Use the free embeddable security headers badge widget to show your live grade on a README, docs site, or footer. It links back to the full report.

Security Headers Checker

Scan any website for HSTS, CSP, X-Frame-Options, and more. Get an instant A+ to F grade with clear fix recommendations — free, no sign-up.

What we check

We request the URL from our infrastructure and grade the six headers that matter most for browser security posture:

Strict-Transport-Security (HSTS) — forces HTTPS and blocks protocol downgrade attacks.
Content-Security-Policy (CSP) — restricts where scripts and resources can load from.
X-Frame-Options — prevents clickjacking via iframes.
X-Content-Type-Options — blocks MIME-type sniffing.
Referrer-Policy — controls how much referrer data leaves your site.
Permissions-Policy — disables unused browser features like camera and geolocation.

How the grade works

Grade	Score	What it means
A+	100	All key headers present and well configured.
A	90–99	Strong posture with minor tightening opportunities.
B / C	70–89	Several headers present; important gaps remain.
D / F	<70	Most headers missing or weakly set — prioritize fixes.

Security posture is only half the story

Headers protect browsers. Uptime monitoring protects your business. Webalert checks your site every few minutes and alerts you the moment it goes down — free forever.

Start Free Monitoring See the Free Plan

See how popular SaaS sites score

Browse live security-header reports for GitHub, Stripe, AWS, Cloudflare, Vercel and 50+ other services.

View security header reports

Frequently asked questions

What are HTTP security headers?: HTTP security headers are response headers that tell browsers how to protect your site against common attacks — clickjacking, MIME sniffing, XSS, and protocol downgrade. Key headers include Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Why do security headers matter for SEO and trust?: Browsers and crawlers treat HTTPS plus modern security headers as a trust signal. Missing HSTS or CSP can leave residual mixed-content and XSS risk that hurts user trust, bounce rate, and how AI systems evaluate whether your pages are reliable enough to cite.
What does an A+ security headers grade mean?: An A+ means every key security header is present and well configured — strong HSTS max-age, a meaningful CSP, clickjacking protection, nosniff, a sensible Referrer-Policy, and a Permissions-Policy. Lower grades mean one or more headers are missing or weakly set.
How do I fix a missing Strict-Transport-Security header?: Serve Strict-Transport-Security with a max-age of at least 15552000 (six months), ideally with includeSubDomains once all subdomains support HTTPS. Most CDNs and reverse proxies (Cloudflare, nginx, Caddy) can add it with a single config line.
Can I embed my security headers grade on my site?: Yes. Use the free embeddable security headers badge to show your live grade on a README, docs site, or footer. It links back to the full report.

Security Headers Checker

What we check

How the grade works

Security posture is only half the story

See how popular SaaS sites score

Frequently asked questions

Related tools

Website Down Checker

Outage Tracker

Free Uptime Monitor