Security Headers Checker

Security headers are directives your server sends in every HTTP response that tell the browser how to behave more safely — which sources may load scripts, whether the site may be framed, whether to force HTTPS, and more. They are a server-side configuration, invisible to users, and among the highest-impact, lowest-effort security improvements you can make.

Content-Security-Policy is the single most powerful header — it restricts where scripts, styles, and other resources can load from, mitigating cross-site scripting and clickjacking. Strict-Transport-Security (HSTS) forces browsers to use HTTPS and prevents downgrade attacks. X-Content-Type-Options: nosniff stops MIME-type confusion attacks. Together these three cover the most common web vulnerabilities.

Where you set them depends on your stack: in Next.js use the headers() function in next.config.js; on Nginx use add_header directives; on a CDN like Cloudflare or Vercel use the dashboard or a config file. Start with X-Content-Type-Options and HSTS (they are safe to enable broadly), then build a Content-Security-Policy carefully and test it in report-only mode before enforcing.

Not directly — Google does not rank you higher for sending them. But they protect against attacks (defacement, injected spam links, malware) that absolutely destroy rankings, and HSTS reinforces the HTTPS that Google does reward. Think of security headers as insurance: they prevent the catastrophic SEO losses that come from a compromised site.