← All the tools

Security headers checker

Reads the headers that decide whether another site can frame your pages, whether script can read your cookies, and whether https is enforced.

This is one of the checks inside Growth Score

Growth Score runs it with the rest on your live site, scores the result and shows what to fix first.

Test your whole siteOpen in your dashboard

Why it matters

Why this is worth checking

Headers are the cheapest security a site has, because they are configuration rather than code, and most sites ship without them because nothing breaks when they are missing.

HSTS is the one worth setting first: without it, the first request a browser makes to your domain can still be plain http.

What it reads

What it looks at

  • HSTS, and how long it lasts
  • Whether others can frame your site
  • A Content-Security-Policy at all
  • Sniffing, referrer and permissions

Reading a result

What a finding means

Each finding says what was seen. This is what it tells you about the page.

No HSTSA browser's first visit to your domain can still be plain http.
No frame protectionOther sites may be able to embed yours inside their pages.
No Content-Security-PolicyThe browser has no allowlist for what a page may load and run.

Common fixes

What to change first

The fixes that come up most, in the order they usually pay off.

Set HSTS firstSend Strict-Transport-Security once every page works on https.
Block framingSend X-Frame-Options or frame-ancestors so only you embed your pages.
Start a CSP in report modeShip a Content-Security-Policy in report-only mode, then tighten it.

In Growth Score

Feeds Trust

Whether visitors and browsers have reason to believe you. It reads your security headers, your email authentication records and the trust signals a visitor can see.

Headers are one layer. A site can carry every one of these and still be insecure in ways no header reaches.

Glossary

Terms behind this check

Trust signalsVisible cues that a business is real and safe, such as reviews, guarantees and security badges.Third-party scriptsCode from outside providers, such as ads, chat widgets and trackers, loaded on your pages.Privacy by designBuilding privacy protections into products and processes from the start, not adding them later.

Go deeper

Guides that cover it

Earn trust on your siteFix the signals software checks, then show the proof a stranger looks for.Compliance basicsAccessibility, privacy and consent basics, in the order that pays off fastest.

FAQ

Questions

Do headers make a site secure?

They are one cheap layer. A site can carry all of them and still be insecure in ways no header reaches.

Can headers break my site?

A strict policy can block scripts you rely on. That is why a policy is best introduced in report-only mode first.

Does the check change my site?

No. It only reads. Nothing is installed, edited or sent to your site by a check.

The other 11

The rest of the checks

Run it with the rest

Growth Score reads your whole site, scores it against sites like yours and ranks what to fix.

Test your whole siteAll the checks

Your Growth Score is 100

Your next fix is waiting in your dashboard.

Open your Growth ScoreOpen dashboard