ShipcheckSecurity headers checker
Paste a URL to grade its HTTP security headers from A+ to F. For anything missing, copy a ready-made config for Vercel, Next.js, Netlify, Nginx, or Apache.
Six headers, about ten minutes of work
Security headers are instructions your server sends with every page. They tell browsers to always use HTTPS, refuse to run scripts from unknown places, and stop other sites from framing yours. Many hosts send few or none of them by default.
Agencies: the Pro portfolio check grades the headers of up to 25 client sites at once and exports a CSV.
Questions
Which security headers matter most?
Strict-Transport-Security (forces HTTPS) and Content-Security-Policy (limits where scripts can load from) carry the most weight. X-Content-Type-Options, frame protection, Referrer-Policy, and Permissions-Policy are quick wins that take one line each.
Will adding a Content-Security-Policy break my site?
It can, if your site loads scripts, styles, or fonts from other domains. Ship it as Content-Security-Policy-Report-Only first, watch the browser console, add the domains you need, then switch to the enforced header.
Is X-Frame-Options still needed?
CSP frame-ancestors replaces it in modern browsers, and we accept either one. Keeping X-Frame-Options as well does no harm and covers older browsers.
How is the grade calculated?
Each header has a weight: HSTS 25, CSP 25, X-Content-Type-Options 15, frame protection 15, Referrer-Policy 10, Permissions-Policy 10. Weak settings get partial credit. 95+ is A+, 85+ A, 70+ B, 55+ C, 40+ D, otherwise F.
Do security headers help SEO?
Not directly. HTTPS is a ranking signal, but the other headers are about protecting your visitors. Clients, security questionnaires, and enterprise buyers do check them, though.
Related tools
Meta tag & social preview checker
See your Google, X, LinkedIn, and Slack previews and fix titles, descriptions, and OG images.
Open tool →Broken link checker
Find dead links, redirects, and missing pages on any public page.
Open tool →Client portfolio health checkPro
Check up to 25 client sites at once: HTTPS, security headers, AI access, sitemap, 404.
Open tool →