Are your security headers doing their job?
Security headers tell browsers how to protect your visitors: force HTTPS, block clickjacking, stop MIME sniffing. Missing ones are a trust signal and a real risk, and most are one line at the server or CDN.
Reads the response headers from outside your network. Nothing is stored.
How this check works
Shipwork requests the page and reads its response headers, checking for HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options and Permissions-Policy, plus any Server or X-Powered-By value that leaks your stack and version.
Questions
- Why do security headers matter for a store?
- They protect your visitors (forced HTTPS, no clickjacking) and they are a trust signal. A site that leaks its server version and sends no security headers looks unmanaged.
- Which header matters most?
- HSTS, because it forces HTTPS on future visits and stops a first-visit downgrade. CSP is the strongest but the hardest to set without breaking the page.
- Are headers a ranking factor?
- Not directly. They are a security and trust signal, and HTTPS itself is a confirmed light ranking factor.