Free Security Headers Checker (A to F Grade)

Indirectly. HTTPS is a ranking signal, and HSTS ensures it is always used. A site compromised by XSS or clickjacking can be flagged as dangerous by Google Safe Browsing, which makes traffic drop. These headers are also part of the trust audits (E-E-A-T) run by agencies and buyers.

It tells the browser to use only HTTPS for this domain for a set period. Without it, a visitor’s first request can go out over HTTP and be intercepted. A one-year duration (max-age=31536000) with includeSubDomains is the standard.

Start in Content-Security-Policy-Report-Only mode with a report-uri or report-to: the browser reports violations without blocking anything. Adjust the policy until no more reports come in, then switch to Content-Security-Policy. Replace 'unsafe-inline' with nonces or hashes.

Both protect against clickjacking. frame-ancestors (in the CSP) is the current standard and lets you allow specific domains; X-Frame-Options is still useful for older browsers. Declaring both is fine.

They reveal the software and its version (nginx/1.18, PHP/8.1…), which makes it easier to look up known vulnerabilities. Hiding them fixes nothing but reduces your exposure.

No, to the tested page. Headers are often set globally, but a CDN, a subfolder or an application can change them. Test your typical pages: homepage, login, API, pages served by another service.