Do security headers affect SEO?

Not directly, but HTTPS and speed are ranking factors, and caching plus compression headers control speed. HSTS also removes a redirect hop for returning visitors.

What should Cache-Control be for HTML?

Short or no-store, because HTML changes with deploys. Long immutable lifetimes belong on fingerprinted assets whose URL changes when their content does.

Why do I not see Content-Encoding in some tools?

Some proxies decompress responses before your client sees them. This tool reports the headers exactly as served to it.

SEO.to / 08

HTTP header checker

Put in a URL and the tool reads the response headers, then tells you which security, caching and compression headers are set and which are missing.

Fetched live, exactly as a crawler receives it.

Which headers matter

Security headers

Strict-Transport-Security: locks the origin to HTTPS. Start with a short max-age, grow it.
Content-Security-Policy: the strongest XSS control. Hard to retrofit, worth it.
X-Content-Type-Options: nosniff: two words, closes MIME sniffing.
Referrer-Policy: strict-origin-when-cross-origin is the sane default.

Performance headers

Cache-Control: immutable + a year for fingerprinted assets; short or no-store for HTML.
Content-Encoding: brotli beats gzip by roughly 15 to 20 percent on text.
Vary: wrong values fragment caches; missing ones poison them.

Security headers are not a ranking factor on their own. Speed and HTTPS are, and both are controlled by headers on this list.

HTTP header checker

Which headers matter

Security headers

Performance headers

Next