# Your Site's Security Headers Are Probably Missing
Your HTTP security headers are either working or they're not—and you won't know which until you check. Most sites ship without them, which means browsers don't know how to protect visitors from XSS attacks, clickjacking, or data theft.
Security headers tell browsers what they're allowed to do with your content. No headers? Your site acts like it has no locks on the doors.
What Is a Security Headers Checker?
Security Headers Checker is a free browser-based tool that scans your domain's HTTP response headers and gives you a letter grade (A through F) based on what's missing. It audits for things like Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, and a dozen other headers that actually matter.
The real value: it shows you exactly which headers you're missing, then gives you copy-paste fixes for Apache, Nginx, or Cloudflare. No login needed.
Why It Matters for SEO
Google doesn't rank you higher for security headers—that's not how this works. But here's what actually happens: a security breach tanks your traffic faster than any algorithm update. If your site gets compromised, you're flagged in search results, blacklisted by browsers, and you lose years of trust.
Security headers also reduce the surface area for attackers. Content-Security-Policy alone blocks about 76% of XSS attacks before they land. Missing headers means you're exposed for no reason.
The second issue is that Googlebot respects security headers when crawling your site. If your headers are misconfigured (too restrictive), the crawler might get blocked or rate-limited, which affects your indexing speed.
How to Use It
- Go to https://scrawl.tools/tools/security-headers—no signup required.
- Paste your domain name (including https://) and click "Check Headers."
- Review your grade and copy the recommended fixes for your server type.
What the Results Tell You
The tool gives you a letter grade and a breakdown of each header. A+ means you've got strict Content-Security-Policy, HSTS enabled, X-Frame-Options set to DENY, and X-Content-Type-Options set to nosniff. That's the goal.
F means you're missing most of them. The report shows you which ones are present, which are misconfigured, and which are absent entirely. It also explains what each header does in plain English—not corporate jargon.
Most importantly, it gives you the exact code to fix it. Copy the Apache block, Nginx block, or Cloudflare rule straight into your config. That's the part people don't expect.
3 Mistakes Most People Make
Mistake 1: Setting headers too strict on day one. A misconfigured Content-Security-Policy will block your own resources—fonts, scripts, images—and break your site. Start with report-only mode, test for a week, then tighten.
Mistake 2: Thinking security headers are optional. They're not. If you're handling any form of user data (even email signups), you need at least HSTS, X-Frame-Options, and X-Content-Type-Options. That's the minimum.
Mistake 3: Ignoring mixed content warnings. If you've got https:// on your domain but you're loading images or scripts from http://, headers will block them. The tool catches this, but you have to actually fix it—not just acknowledge the warning.
Next Steps
Run your domain through the Security Headers Checker right now and see where you actually stand. Most sites score D or lower, and fixing it takes 15 minutes if you copy the provided code blocks.
How to Use It Step by Step
- Open the tool and locate the domain input field. Enter your full domain URL starting with https:// (for example: https://yoursite.com). The https:// prefix matters—it tells the checker to look at your secure connection headers.
- Click "Check Headers" and wait 5–10 seconds for the scan to complete. The tool makes a request to your domain and reads back all HTTP response headers your server is sending.
- Review your letter grade at the top of the results page. This is your overall security posture. Don't aim for perfection on day one—aim for B or better as a starting point.
- Read the header breakdown section by section. Each header gets flagged as "Present," "Missing," "Misconfigured," or "Missing Recommended Value." Pay special attention to the orange and red flags.
- Find your server type in the recommended fixes section. Look for Apache, Nginx, or Cloudflare tabs depending on where your site is hosted. If you're unsure, ask your hosting provider or check your control panel.
- Copy the entire code block for your server type. Don't cherry-pick headers—take the full recommendation. Paste it into your server configuration file (typically .htaccess for Apache, nginx.conf for Nginx, or your Cloudflare dashboard rules).
- Save and reload your configuration. For Nginx or Apache, restart the service after making changes. For Cloudflare, save the rules and wait a few seconds for them to deploy globally.
- Re-run the checker 2–3 minutes later using the same domain. Your new grade should appear. If something broke (missing images, CSS, or fonts), revert the changes and read the "report-only" instructions in the tool results.
Common Mistakes to Watch For
- Copying headers without understanding your site's dependencies. If your site loads fonts from Google, images from a CDN, or scripts from a third-party service, a strict Content-Security-Policy will block all of it. Always test in report-only mode first and monitor your browser console for blocked resources before enforcing.
- Applying fixes to the wrong server config file. Apache servers use .htaccess or httpd.conf; Nginx uses nginx.conf; managed hosting platforms use their dashboard. Pasting an Nginx block into an Apache server won't work and may cause parsing errors. Double-check your hosting setup before copying code.
- Forgetting to include wildcard domains in HSTS or CSP rules. If your site uses subdomains (api.yoursite.com, blog.yoursite.com), your security headers need to cover them too. The checker results will flag this if it detects subdomains.
- Not updating headers when you change your hosting or CDN provider. If you switch from one service to another, your old IP allowlists and domain rules in your security headers become invalid. Re-run the checker after any infrastructure change.
- Setting max-age too high on HSTS without testing first. The Strict-Transport-Security header can lock your domain into HTTPS-only mode for months or years. Start with a low max-age (like 86400 seconds = 1 day) and increase it only after a week of smooth operation.
Troubleshooting & Common Questions
Why does my site load fine in Firefox but images break in Chrome after I add security headers?
Different browsers enforce Content-Security-Policy differently, and Chrome is stricter about blocking mixed content (HTTP resources loaded over HTTPS). Check your browser's developer console (F12 → Console tab) for blocked resource warnings. These warnings show you exactly which domains or protocols you need to allowlist in your CSP rule.
Can I test security headers on a staging site before applying them to production?
Yes—this is actually recommended. Set up your staging domain (like staging.yoursite.com) with the same server type and configuration as your production site, apply the security headers there first, and run the checker against the staging URL. Once you confirm nothing breaks, migrate the same code to production.
What should I do if the checker says a header is "misconfigured" but my site looks fine?
Misconfigured typically means the header exists but has syntax errors or conflicting values. The tool will highlight what's wrong in red. Even if your site appears to work, a misconfigured header may not actually be protecting you—it's just noise. Use the tool's recommended fix to correct it to a properly formatted version.