What we offer

NEW CASE
Antana

We create digital solutions that work for businesses

Become a clientBecome a client
Give us a call +38 (066) 35-14-529

Let's take the first step towards your website — write to us

Close
Tools

Security Headers Check

Security and access

You may also like

Security headers: HSTS, CSP, X-Frame-Options.

Server response codes

The first thing a server returns. Three digits explain what happened to the page.

200 All good, the page exists. Every URL in your sitemap should return this.
301 / 302 Redirects, permanent and temporary. Mixing them up costs search rankings.
404 The page is gone. Fine for removed URLs, bad when your own links still point there.
403 Access denied. Often the result of wrong file permissions after a migration.
500 / 503 Server error and temporary unavailability. For search, 503 is safer: it means “come back later”.

Headers that affect SEO

X-Robots-Tag The same noindex but at server level. Insidious because it is invisible in the page source — only in the headers.
Link: rel=canonical A canonical set by header. When it contradicts the tag in the page, Google decides for itself.
Cache-Control How long the browser keeps the page. Sensible values noticeably speed up repeat visits.
Content-Encoding gzip or brotli compression. Without it the page transfers at full size, and the speed shows it.

Security headers

A few lines in the server config close off entire classes of attack.

Strict-Transport-Security Tells the browser to use https only. Protects against interception on open Wi-Fi.
X-Content-Type-Options Stops the browser guessing file types. Without it an uploaded image can be served as a script.
X-Frame-Options Prevents your site being framed inside someone else’s page. Protection against fake buttons over your interface.
Content-Security-Policy A list of sources allowed to load scripts. The most effective protection, but it needs careful configuration.

Website security headers check

The service requests your site and checks six key security headers: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. Green mark — the header exists, red — it is missing.

These headers are basic security hygiene: they protect visitors from traffic interception, XSS attacks and clickjacking, and they are also a trust plus for Google. Most template sites have none of them. They are added with a few lines in .htaccess or the Nginx config — we do this for clients as part of website support.

FAQ

Why are security headers needed?
They protect visitors from attacks: HSTS enforces HTTPS, CSP blocks injection of foreign code (XSS), X-Frame-Options prevents clickjacking.
What is HSTS?
HSTS (Strict-Transport-Security) tells the browser to always open the site via HTTPS only, even if the user typed http. It protects against traffic interception.
What is CSP?
CSP (Content-Security-Policy) defines where the site is allowed to load scripts, styles and images from. It is the main protection against XSS attacks.
How to add these headers?
On Apache via .htaccess with Header set directives, on Nginx in the config via add_header. BB STUDIO configures them for clients automatically.
Telegram Viber Call us