Groups of checks
- Caching: Cache-Control, ETag, Last-Modified, Expires and Age.
- Content: Content-Type and charset, and compression with Content-Encoding (we accept br and gzip, so an uncompressed answer means the server didn't compress).
- Security: HTTPS, Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and framing protection.
- Server: Server, X-Powered-By and Via, passively read from the response.
- SEO: X-Robots-Tag and canonical Link headers.
About the results
Missing security headers are shown as information, not failures: what a site needs depends on what it does. Headers can differ by visitor, country or CDN edge; this shows what RankCortex's server received.
Frequently asked questions
Why do I see a Cloudflare server header?
When a CDN or proxy sits in front of your site, the headers come from it. Your own server's headers may be hidden or rewritten.
Is X-Powered-By a problem?
It isn't a vulnerability by itself, but it tells attackers which software and version you run, so many sites remove it.