Check the six response headers that harden a site against common attacks.
Free, no signup. We fetch the page once and read what your server sends back.
Security headers are not a ranking factor. They matter because a compromised or defaced site loses rankings very quickly, and because most of these are a single line of configuration that nobody ever got round to adding.
Not directly. A hacked site loses rankings fast, and Google shows warnings on sites flagged as compromised, so the indirect connection is real.
X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN and a Referrer-Policy. All three are low-risk one-liners.
It is hard to reverse. Browsers remember it for the max-age you set, so if HTTPS breaks later the site becomes unreachable. Start with a short max-age.
It is the strongest defence against cross-site scripting and the most effort to configure without breaking your own scripts. Deploy in report-only mode first.
Run the full free report, or have us go through it with you on a call.