Are your security headers doing their job?

Security headers tell browsers how to protect your visitors: force HTTPS, block clickjacking, stop MIME sniffing. Missing ones are a trust signal and a real risk, and most are one line at the server or CDN.

Reads the response headers from outside your network. Nothing is stored.

How this check works

Shipwork requests the page and reads its response headers, checking for HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options and Permissions-Policy, plus any Server or X-Powered-By value that leaks your stack and version.

What the security headers check reads

The check requests your page and reads the response headers. It looks for six headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options and Permissions-Policy. It reports which are present and which are absent, with a short note on what each one does.

It also notes the Server and X-Powered-By values when they are present, since those can reveal the software or version behind the site. If the page is served over plain HTTP it reports that as an error, and if the content type is not HTML it says so. It reads one response, so it describes that URL and whatever layer in front of it sets headers. A header that is present on one route may still be absent on another, so check the pages that matter to you.

How to read the header result

A present header means the response included it. A missing HSTS or X-Content-Type-Options is reported as a warning, the others as information. Missing does not always mean unprotected: a header can be set at a proxy, content delivery network or edge layer rather than the origin, and a single response shows only the final set.

The check does not score the values, test the policy or confirm that a browser would accept it. A Content-Security-Policy that is present but too loose, or an HSTS value with a short lifetime, is not judged here. Treat the result as a presence list and inspect the actual values when you tune them.

Common causes and why they matter

Headers are often missing because the site sits behind a platform that sets few by default, or because an app or proxy adds them for only some routes. HSTS forces future visits over HTTPS and stops a downgrade on the first visit. X-Content-Type-Options stops MIME sniffing, and X-Frame-Options or a CSP frame-ancestors rule limits clickjacking.

Leaking a server version tells an attacker what to try. These are security and trust signals rather than ranking factors, though HTTPS itself is a light signal. A store that sends no security headers and advertises its stack looks unmanaged, and protecting visitors is the main reason to set them.

How to fix missing headers

Add the headers at the layer that serves every route, usually the content delivery network, proxy or platform configuration rather than a single app file. A typical HSTS value is max-age=31536000; includeSubDomains. Set X-Content-Type-Options to nosniff. Build the content security policy last, because a strict policy can break scripts and images if it is not tested.

On Shopify, some headers are set by the platform and others depend on your app or proxy, so check what actually reaches the visitor. In WooCommerce, the web server or proxy config usually owns them. Remove or trim the Server and X-Powered-By values where the platform allows it. Add one header at a time and confirm it still appears after any cache purge, then re-run the check.

When to use related delivery checks

Use TLS check for the certificate itself and mixed content for HTTPS pages that load resources over HTTP. Use the delivery check for how the response looks to a crawler.

For a broader pass, the site audit includes delivery signals, and the free website audit checklist explains where security and trust fit among the other checks. Recheck after any change to the platform, proxy or content delivery setup.

Questions

Why do security headers matter for a store?

They protect your visitors (forced HTTPS, no clickjacking) and they are a trust signal. A site that leaks its server version and sends no security headers looks unmanaged.

Which header matters most?

HSTS, because it forces HTTPS on future visits and stops a first-visit downgrade. CSP is the strongest but the hardest to set without breaking the page.

Are headers a ranking factor?

Not directly. They are a security and trust signal, and HTTPS itself is a confirmed light ranking factor.

How do I check my security headers?

The check requests your page and reads its response headers, looking for HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options and Permissions-Policy. It also reports any Server or X-Powered-By value that reveals the stack and version.

Which security header matters most?

HSTS, because it forces HTTPS on future visits and stops a downgrade on the first one. The content security policy is the strongest protection but the hardest to set without breaking the page. X-Content-Type-Options and the framing headers are the next simplest wins.

Do security headers affect SEO rankings?

Not directly. They are a security and trust signal rather than a ranking factor, though HTTPS itself is a confirmed light signal. The main benefit is protecting visitors from downgrades, MIME sniffing and clickjacking, and looking managed rather than neglected.

Why does the check say a header is missing when my host sets it?

The header may be set at the origin while a proxy, content delivery network or cache serves the visitor without it, or it may apply to only some routes. The check reads the final response for the URL you submitted, so confirm what actually reaches the visitor.

Does the check grade the header values?

No. It reports presence or absence and flags version leaks. It does not judge whether an HSTS lifetime is long enough or whether a content security policy is strict. Inspect the values yourself when you are tuning them.

Keep reading

What this reads

Reads the response headers your server returns to a browser.
Reports which security headers are set and which are missing.
The headers are the ones browsers enforce; no account or install is needed.

83checks

0signups needed

0stored on free checks

Cool, just ran an audit and got some insights! Let’s see if I can fix them :)

Tenta Dev, @DevTenta

Whoah! this site is crazy, nothing to roast at all

Ainreek, @AinreekAI

cool as heck, tried it on my blog and the insights it gave are helpful and not bluff.

Refaat 🍉 (Mouse), @1Mouse__