Security headers checker

Browsers warn visitors about insecure sites, and Google prefers HTTPS. Check the basics that keep your visitors safe.

Free, no sign-up. Checks one page in about 20 seconds. We fetch it like a search engine and don't keep your content.

Which security headers does it check?

  • HTTPS with no insecure (mixed) content, and http:// redirecting to https://.
  • HSTS with a long enough max-age.
  • X-Content-Type-Options, Referrer-Policy, Permissions-Policy and clickjacking protection (X-Frame-Options or CSP frame-ancestors).
  • Whether your server advertises its software version.

Many of these can be switched on in one place if your site is behind a CDN such as Cloudflare.

Frequently asked questions

Does HTTPS help SEO?

Yes – Google uses HTTPS as a light ranking signal, and browsers label plain HTTP pages 'Not secure', which puts visitors off.

What is HSTS?

HTTP Strict Transport Security tells browsers to only ever use HTTPS for your site, which blocks downgrade attacks. Turn it on once your whole site works over HTTPS.

More free SEO tools

Free SEO check

Full single-page audit: Google readiness, AI search, speed, security and local SEO.

AI SEO checker

Can ChatGPT, Claude, Perplexity and Google AI Overviews read and cite your site?

Website audit

Crawl up to 250 pages for broken links, duplicate titles and orphan pages.

Competitor comparison

Your site against up to two competitors, side by side.

SEO monitoring

A free weekly re-check with a score history graph.

Title tag checker

See your title and description in pixels, exactly as Google cuts them.

robots.txt tester

Paste your rules and test any URL against Googlebot or AI crawlers.

llms.txt generator

Create an llms.txt file that gives AI assistants a map of your site.

Mobile-friendly test

Check your page works on phones – Google's own test closed in 2023.

Broken link checker

Find links on your site that lead to errors or redirects.

Schema checker

Validate your structured data and see Google's required properties.

Page speed checker

Core Web Vitals from real Chrome users plus a Lighthouse test.

Sitemap checker

Check your XML sitemap is found, valid and listed in robots.txt.

Local SEO checker

LocalBusiness markup, contact details and map signals for UK businesses.

Meta tag generator

Title, description, canonical, robots and social tags, ready to paste.

Open Graph generator

Control how your link looks on Facebook, LinkedIn, WhatsApp and X.

XML sitemap generator

Find your pages and download a valid sitemap.xml.

robots.txt generator

Block AI training bots while staying visible in AI search.

Local business schema generator

LocalBusiness JSON-LD for Google and AI assistants.

Long-tail keyword generator

Turn one topic into dozens of winnable search phrases.

Blog title generator

Headline ideas measured to fit Google's results.

Word counter

Words, characters, reading time, readability and keyword density.

Keyword difficulty checker

How hard is page one? We grade the pages that rank now.

Plagiarism checker

Find copies of your text across the web – no word limit.

Anchor text checker

Grade every link on a page and generate better anchors.

Want the fixes done for you? XKey is made by IceWork, a web studio in Blackpool. IceWork builds fast, search-ready websites – a 3-page site including domain and a year's hosting is £350 all in.