Security Headers Checker
One of the free tools from KinetixSEO, an SEO and AI-citation (GEO) checker. This tool checks any page for the HTTP response headers browsers rely on to stop clickjacking, content-sniffing attacks, and cross-site scripting — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — plus mixed-content resources and forms that submit over plain HTTP. Missing headers don't directly change rankings, but Google flags insecure pages in Chrome, and a hardened site is one attackers, and audits, pass over.
Frequently asked questions
What is HSTS (Strict-Transport-Security) and why does it matter?
HSTS tells browsers "always use HTTPS for this site, never fall back to HTTP" for a set period of time. Without it, a visitor who types your domain without "https://", or clicks an old http:// link, briefly connects over plain HTTP first — a window an attacker on the same network (public WiFi, a compromised router) can use to intercept or redirect the request. Fix: add `Strict-Transport-Security: max-age=31536000; includeSubDomains` at the web server or CDN level once your whole site serves HTTPS.
What does a Content-Security-Policy (CSP) header actually do?
CSP is an allow-list telling the browser exactly which sources are allowed to run scripts, load styles, or embed content on your page. It’s the single strongest defense against cross-site scripting (XSS): even if an attacker manages to inject a `<script>` tag through a comment field or a compromised third-party widget, a correct CSP stops the browser from executing it. Fix: start with a report-only policy (`Content-Security-Policy-Report-Only`) to see what would break, then tighten it to a real enforced policy.
Why is X-Frame-Options missing flagged as a problem?
X-Frame-Options (or the newer `frame-ancestors` directive in CSP) controls whether another site can load your page inside an `<iframe>`. Without it, an attacker can overlay invisible buttons from your site under their own page and trick visitors into clicking "delete account" or "confirm payment" while they think they’re clicking something else — a technique called clickjacking. Fix: set `X-Frame-Options: SAMEORIGIN` (or `DENY` if you never frame your own pages).
What does X-Content-Type-Options: nosniff protect against?
Some older browsers try to guess a file’s real type by inspecting its content instead of trusting the `Content-Type` header the server sent — so a file uploaded as an "image" that actually contains HTML/JS can get executed as a script. `X-Content-Type-Options: nosniff` disables that guessing, forcing the browser to respect the declared content type. Fix: it’s a single static header with one valid value — add `X-Content-Type-Options: nosniff` to every response and leave it there.
What is Referrer-Policy and why should I set it?
When a visitor clicks a link from your page to another site, the browser can send the full URL they came from (including query strings, which sometimes carry emails, tokens, or search terms) in the `Referer` header. Referrer-Policy controls how much of that URL leaks. Fix: `strict-origin-when-cross-origin` is the safest general-purpose default — it sends the full URL to same-origin requests but only the origin (no path or query) to other sites.
This is one check from KinetixSEO's full SEO/GEO audit. Want the complete picture — Core Web Vitals, AI-citation readiness, technical SEO health, and tailored fixes? Run the free full checker.