TheSeoSoul
Free tools/Technical

Free Security Headers Checker

See which HTTP security headers your live URL returns — HSTS, CSP, X-Content-Type-Options, framing, Referrer-Policy, and a few extras. Free, no signup, no fake “security grade” theater beyond a clear presence score.

How it works

  1. 01

    Fetch the live URL

    We follow sensible redirects and read response headers from the final HTML response.

  2. 02

    Score core headers

    HSTS, X-Content-Type-Options, CSP, X-Frame-Options, Referrer-Policy, plus HTTPS, form the core score used in our full audit.

  3. 03

    Surface raw values

    Present headers show their values so you can paste them into your CDN or server config review.

What this security header tool validates

  • Strict-Transport-Security (HSTS) and preload eligibility
  • Content-Security-Policy (CSP) framing and script controls
  • X-Content-Type-Options: nosniff for MIME-sniffing protection
  • X-Frame-Options / frame-ancestors to prevent UI redressing
  • Referrer-Policy to prevent leaking confidential query parameters

Scenarios

Security Headers Architecture & Practical Scenarios

Deploying modern security headers protects user trust and ensures strict protocol compliance across all browsers:

HSTS Policy

Enforcing Permanent HTTPS (HSTS)

The Problem: Browsers initially requesting http:// before redirecting to https:// remain vulnerable to SSL stripping attacks on insecure networks.

The Fix: Serve Strict-Transport-Security with max-age=31536000 and includeSubDomains to force browsers to always use HTTPS.

Clickjacking Defense

Preventing Malicious iFrame Embedding

The Problem: Third-party sites embedding your application inside hidden <iframe> layers to perform clickjacking attacks on authenticated users.

The Fix: Set X-Frame-Options: DENY or Content-Security-Policy: frame-ancestors 'none'.

Referrer Privacy

Preventing Query String Leakage in Outbound Clicks

The Problem: Default referrer policies leaking internal URLs containing user tokens or private query strings to external domains.

The Fix: Deploy Referrer-Policy: strict-origin-when-cross-origin to send full paths only within the same origin.

Production Security Headers Implementation

Configure headers in your server or edge framework:

Next.js App Router (next.config.ts) Security Headerstypescript
import type { NextConfig } from 'next';

const nextConfig: NextConfig = {
  async headers() {
    return [
      {
        source: '/:path*',
        headers: [
          { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' },
          { key: 'X-Content-Type-Options', value: 'nosniff' },
          { key: 'X-Frame-Options', value: 'DENY' },
          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
          { key: 'Content-Security-Policy', value: "base-uri 'self'; object-src 'none'; frame-ancestors 'none'" },
        ],
      },
    ];
  },
};

export default nextConfig;
Nginx Security Headers Configurationnginx

Add to your Nginx server block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Frequently asked questions

Which security headers matter for SEO?
HTTPS itself is a ranking and trust baseline. Headers like HSTS, X-Content-Type-Options, and framing policies protect users; broken TLS or mixed content still hurts crawlability and conversions more than a missing CSP.
Does a missing CSP tank rankings?
Usually no — CSP is primarily a security control. Still, sites with weak TLS or mixed HTTP assets can see crawl and UX issues that indirectly hurt SEO.
Do you grade CSP quality?
This tool reports presence and the raw header value. Strength reviews (unsafe-inline, report-only, etc.) are still a human / WAF job.
Is this free?
Yes — free, no registration on TheSeoSoul.

Keep going

What to check next

Headers protect the browser — these tools check crawl and TLS next.

Need the whole picture? Run a full audit · browse every tool.