SSL & Security Headers Audit
Enter a URL to instantly audit your site's HTTPS status and whether key security headers like HSTS, CSP and X-Frame-Options are present.
What is the SSL & Security Headers Audit?
Security headers are HTTP headers your server sends with every response that tell the browser how to protect your site. This tool checks whether your site uses HTTPS and whether key security headers like HSTS, CSP and X-Frame-Options are present, listing what's missing. A secure site improves both visitor trust and SEO.
How to use it
- 1Enter the address of the site you want to audit.
- 2Press 'Check'; the HTTPS status and header score appear instantly.
- 3Add the missing (red) headers to your server to improve security.
How to read the result
When to use it
Production Deployment Audits
DevOps teams use this before shipping new releases to verify Nginx or Apache directives, catching missing HSTS or improper frame protections instantly.
Payment Security Compliance
E-commerce stores verify CSP and clickjacking protections ahead of merchant audits, ensuring checkout forms cannot be framed or injected with rogue scripts.
Technical SEO Hardening
Agencies auditing client infrastructure assess server-side response headers to identify critical trust and transport vulnerabilities without needing direct SSH access.
Common mistakes
Enforcing CSP Without Testing
Enforcing strict CSP directives without testing via Content-Security-Policy-Report-Only first often breaks essential third-party scripts, analytics tags, and payment gateways across the domain.
Insufficient HSTS Max-Age
Setting the HSTS max-age directive to only a few days fails browser trust thresholds; Chrome HSTS preload inclusion strictly requires at least 31536000 seconds.
CDN Header Stripping
Configuring security headers solely on the origin server while caching through edge proxies frequently strips custom headers, leaving visitors completely unprotected against protocol downgrades.
Frequently asked questions
Do security headers affect SEO?
HTTPS is a direct ranking signal. The other security headers are not direct ranking factors, but a secure, trustworthy site improves user trust and avoids browser warnings.
How do I add these headers?
Headers are added in your server config: 'add_header' in Nginx, 'Header set' in Apache, or your app's header settings (e.g. Next.js next.config). For each missing header, add the corresponding rule.
Do I have to add all of them?
No, but the four marked 'important' (HSTS, CSP, X-Frame-Options, X-Content-Type-Options) give a strong baseline. CSP is the strongest protection but needs careful configuration.
I have HTTPS but HSTS is missing — is that a problem?
HTTPS is a sufficient start; HSTS adds protection by forcing the browser to always use HTTPS. Adding it is recommended, but first make sure HTTPS works smoothly on all pages.
How do edge CDNs affect security header deployment?
Edge CDNs can inject or strip security headers before traffic reaches visitors, regardless of origin settings. Services like Cloudflare allow configuring Transform Rules or Edge Workers to attach HSTS, CSP, and Permissions-Policy globally. Deploying headers at the CDN level ensures consistent security across microservices and origin servers.
What is the purpose of the Permissions-Policy header?
The Permissions-Policy header explicitly restricts browser APIs such as geolocation, microphone, and camera access on your domain. It stops embedded third-party widgets, iframes, and advertising scripts from silently accessing sensitive user hardware. Implementing it protects visitor privacy and hardens your web application against supply-chain compromise.