Question 1

What are security headers and why do they matter?

Accepted Answer

Security headers are HTTP response headers that tell browsers how to handle your site's content. They protect against common attacks like clickjacking (X-Frame-Options), MIME sniffing (X-Content-Type-Options), and cross-site scripting (Content-Security-Policy). Google uses site security as a ranking signal, making these headers important for both security and SEO.

Question 2

What is HSTS (Strict-Transport-Security)?

Accepted Answer

HSTS tells browsers to always connect to your site via HTTPS, even if a user types http:// in the address bar. This prevents man-in-the-middle attacks and insecure redirects. The max-age directive sets how long (in seconds) the browser should remember this rule. A value of 31536000 (one year) is recommended.

Question 3

What is Content-Security-Policy (CSP)?

Accepted Answer

CSP controls which resources (scripts, styles, images, fonts, etc.) the browser is allowed to load on your page. It's one of the most effective protections against cross-site scripting (XSS) attacks. A strict CSP can prevent malicious scripts from executing, even if an attacker manages to inject them into your page.

Question 4

How do caching headers affect SEO?

Accepted Answer

Caching headers (Cache-Control, ETag, Last-Modified) control how browsers and CDNs cache your content. Proper caching improves page load speed, which is a Google ranking factor. The Cache-Control header tells browsers how long to store a resource before requesting a new version.

Question 5

What does the security grade mean?

Accepted Answer

The security grade (A to F) is based on how many of the five key security headers your site implements: X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security, Content-Security-Policy, and Permissions-Policy. Grade A means all five are present. Each missing header lowers the grade.

Check your HTTP headers
in one click.

Three steps to better security.

Enter any URL

Review the results

Fix and re-check

Common questions about HTTP headers.

Go beyond header checks.

Check your HTTP headersin one click.