Security Headers Analyzer
Grade any site A+ to F on CSP, HSTS and core security headers — with ready-to-paste fixes.
Raw response headers
This analyzer fetches any URL and grades its HTTP security headers the same way securityheaders.com does — but with actionable, copy-paste nginx fixes for every missing header. Pair it with the Technology Profiler to get a complete picture of any site's stack and posture.
Frequently Asked Questions
What are HTTP security headers?
Security headers are instructions a web server sends with every response that tell browsers how to behave defensively: Content-Security-Policy restricts where scripts can load from, Strict-Transport-Security forces HTTPS, X-Frame-Options blocks clickjacking, and so on. They are one of the cheapest, highest-impact hardening steps a site can take.
How is the A+ to F grade calculated?
The grade counts how many of the six core headers are present (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). All six earn an A; an A+ additionally requires at least one cross-origin isolation header (COOP/CORP/COEP) and no weakening flags like unsafe-inline in your CSP.
Will missing security headers hurt my SEO?
Not directly — Google does not rank by security headers. However, HSTS protects the HTTPS experience Google does measure, and a hardened site is less likely to get hacked and blacklisted, which absolutely destroys rankings. Treat headers as insurance for your SEO investment.
How do I add the missing headers?
Every missing header in your report includes a ready-to-paste nginx fix snippet. On Apache, use Header always set directives in .htaccess; on WordPress with nginx, add the snippets to your server block and reload. Start with X-Content-Type-Options and HSTS (lowest risk), test CSP in report-only mode first.
What is information disclosure and why is it flagged?
Headers like Server: nginx/1.24.0 or X-Powered-By: PHP/8.3 reveal exact software versions, which lets attackers look up version-specific exploits. The report flags them so you can strip or genericize them.