HTTP Security Headers Explained: CSP, HSTS, and the Rest
What HTTP security headers do, why they matter for both security and SEO trust, and a plain-English walkthrough of CSP, HSTS, X-Frame-Options, and the other headers worth adding.
Win the click before the page even loads: craft meta tags, structured data, sitemaps and robots rules, and preview exactly how you appear on Google and social.
51 tools available
Generate perfect SEO meta tags, Open Graph and Twitter Card markup with a live Google snippet and social-card preview, copy the ready-to-paste <head> code, 100% in your browser.
Paste a page's HTML to audit its title, description, canonical, robots, Open Graph and Twitter Card tags: with a length score, missing/duplicate checks and a live search & social preview, 100% in your browser.
Write a click-worthy SEO meta description with a live character + pixel meter, a real Google snippet preview and ready-to-edit templates, copy the tag, 100% in your browser.
Type a page title and your brand and see a live Google title preview, desktop and mobile, with exact character and pixel limits and a truncation warning. 100% in your browser.
Build correct Open Graph (og:) meta tags and see a live Facebook and LinkedIn share-card preview as you type, copy the ready-to-paste markup, 100% in your browser.
Generate Twitter Card meta tags for X with a live card preview. Pick summary or large image, set the title, description, image and @handles, then copy the ready-to-paste twitter:* markup. 100% in your browser.
Build a clean rel=canonical tag from any URL: normalise the host, path and query, strip tracking parameters, and copy the ready-to-paste <link> tag, HTTP header and framework snippets, 100% in your browser.
See exactly how your page looks when shared on Facebook, LinkedIn, X, WhatsApp, Telegram, Discord, Slack and Teams, and diagnose why the image, title or preview is wrong or out of date. Paste your HTML for a full, private, in-browser report.
Generate valid JSON-LD structured data for Article, FAQ, Product, Organization, LocalBusiness, Event and more, with a live rich-results validity check and a copy-ready script tag. 100% in your browser.
Turn a list of questions and answers into valid FAQPage JSON-LD structured data, with a live validity check for the Google FAQ rich result and a copy-ready script tag. 100% in your browser.
Generate valid Article, BlogPosting and NewsArticle JSON-LD structured data: with author, publisher, dates, images and keywords, a live SERP preview and a rich-results validity check. 100% in your browser.
Generate valid Product JSON-LD structured data with Offer price, availability and AggregateRating, for price and star-rating rich results in Google. Live validity check, copy-ready script tag, 100% in your browser.
Build valid Organization JSON-LD structured data (name, logo, URL, sameAs social profiles and typed contact points) with a live validity check and a copy-ready script tag. 100% in your browser.
Build valid LocalBusiness JSON-LD structured data (address, geo coordinates, a full opening-hours table, price range and social profiles) with a live validity check and a copy-ready script tag. 100% in your browser.
Generate valid SoftwareApplication JSON-LD for apps, SaaS and games (category, operating system, price and star rating) with a live rich-results validity check and a copy-ready script tag. 100% in your browser.
Generate valid Review JSON-LD structured data (reviewed item, author, star rating and review body) with a live star preview, a required-property check and a copy-ready script tag. 100% in your browser.
Generate valid Person JSON-LD structured data (name, job title, employer, bio and sameAs profile links) with a live validity check and a copy-ready script tag. 100% in your browser.
Generate valid Event JSON-LD structured data (dates, venue or virtual location, organizer, performer and ticket offers) with a live rich-results validity check and a copy-ready script tag. 100% in your browser.
Build valid BreadcrumbList JSON-LD from an ordered trail of pages, with a live Google-style breadcrumb preview, auto-numbered positions and a copy-ready script tag. 100% in your browser.
Generate valid VideoObject JSON-LD structured data (name, thumbnail, upload date, duration and content URL) with a live check for Google video rich results. ISO-8601 duration handled for you, 100% in your browser.
Generate valid Recipe JSON-LD structured data for Google's recipe rich result: ingredients, steps, prep/cook times, yield, nutrition and star ratings, with a live eligibility check and copy-ready script tag. 100% in your browser.
Turn a list of URLs into a valid sitemap.xml with per-URL changefreq, priority and lastmod, validated against the 50,000-URL limit and ready to submit to Google. 100% in your browser.
Turn a list of URLs into a clean, nested HTML sitemap page, a linkable <ul> tree grouped by path that you can paste straight into any site. Boosts internal linking and navigation. 100% in your browser.
Map each page to the images it hosts and generate a valid Google image sitemap (image:image, image:title, image:caption) to get pictures indexed in Google Images. 100% in your browser.
Turn your hosted videos into a Google-valid video sitemap: thumbnail, title, description, player/content URL, duration and publish date per video: validated live and downloadable. 100% in your browser.
Build a valid Google News sitemap from your recent articles (with publication name, language, title and W3C publication date) and get warned about the 48-hour recency window and 1,000-URL cap. 100% in your browser.
Paste your sitemap.xml and validate it instantly: well-formed XML, every <url> has a <loc>, the 50,000-URL limit, HTTPS locations and valid changefreq/priority. Catches the errors that make Google reject a sitemap. 100% in your browser.
Build a valid robots.txt with user-agent groups, allow/disallow rules, crawl-delay, sitemap and host directives, with live output, presets and lint warnings. 100% in your browser.
Paste your robots.txt to parse it into User-agent groups and catch the mistakes that block Google: a stray Disallow: /, rules before any User-agent, unknown directives and a missing sitemap. 100% in your browser.
Preview exactly how your page appears in Google search (desktop and mobile) as you type your title, URL and meta description, with live pixel-width truncation warnings. Nothing is uploaded.
Preview exactly how your link unfurls on Facebook and LinkedIn, paste your page's HTML or type the fields, with a live share card and a plain-English audit of every missing or oversized Open Graph tag. Nothing is uploaded.
Preview exactly how your page will look when shared on X (Twitter), summary and large-image cards, as you type your title, description and image, or paste your page's HTML. Live warnings catch broken cards before you post. Nothing is uploaded.
Paste JSON-LD or a page's HTML to detect schema types, validate required properties, and see which Google rich results your structured data is eligible for, 100% in your browser.
Paste any URL and instantly break it into protocol, host, port, path, every query parameter, hash and origin, with a live rebuilt URL to confirm the parts. 100% in your browser.
Turn any title or text into a clean, SEO-friendly URL slug: pick the separator, case, length and transliteration, and slugify a whole list at once. Copy or download the results, 100% in your browser.
Build clean, correctly-encoded UTM campaign URLs from a form: set source, medium, campaign, term and content, see the live parameter table GA4 reads, then copy or download the tracking link. 100% in your browser.
Build clean, correctly-encoded UTM & campaign tracking URLs with channel presets, custom parameters and a live parameter table, copy the ready-to-share link, 100% in your browser.
Paste HTML and instantly check well-formedness plus on-page SEO (title, meta description, lang, image alt text and heading order) with a live outline. 100% in your browser.
Paste your CSS and instantly catch unbalanced braces, unclosed and empty rules, and unterminated comments or strings, each pinpointed to a line, 100% in your browser.
Paste your JSON-LD structured data to validate it, parse errors, missing @context/@type, and the required & recommended properties each schema.org type needs for rich results, plus a re-formatted copy. 100% in your browser.
Paste JSON-LD or a full HTML page and validate every structured-data block against schema.org, required vs recommended properties, per-@type checks and rich-result notes. 100% in your browser.
Paste your page's HTML and validate its meta tags against SEO best practices: title and description length, canonical, robots, viewport, charset, Open Graph and Twitter completeness: as a graded pass/fail checklist, 100% in your browser.
Paste raw HTTP response headers to parse them into a clean table and get instant notes on status, redirects, caching, compression, cookies, CORS and a graded security-header report, 100% in your browser.
Paste your HTTP response headers and get an instant A–F security grade with per-header pass/warn/fail verdicts and copy-ready fixes for HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, 100% in your browser.
Paste a PEM/X.509 certificate to extract its SHA-1 & SHA-256 fingerprints, DNS names and identity strings, then work through a complete TLS/SSL hardening checklist: 100% in your browser, nothing uploaded.
Build a correct Content-Security-Policy header from a friendly per-directive form (script, style, img, connect, font and frame sources) with a plain-English explanation and a live strictness meter. 100% in your browser.
Paste your HTML to see the full H1–H6 outline as a tree and catch structural problems (missing H1, multiple H1s, skipped levels and empty headings) with a plain-English fix for each. 100% in your browser.
Paste any text to estimate reading time at an adjustable words-per-minute pace, with live word, sentence, paragraph and character stats, 100% in your browser.
Paste text or HTML and see your top keywords and 2- & 3-word phrases with counts and density %, stopwords filtered and keyword-stuffing flagged. 100% in your browser, nothing uploaded.
Count words, characters, sentences, paragraphs and reading time live as you type or paste, with a keyword breakdown and platform length limits. 100% in your browser.
Count characters with and without spaces, plus words, bytes and lines, and check your text live against Twitter/X, meta title, meta description and SMS limits, 100% in your browser.
Optimizing a page usually means jumping between a validator, a SERP mockup, a schema reference and three Stack Overflow tabs. This toolkit collapses that into one place: fill in a form, watch the search and social previews update as you type, then copy production-ready markup straight into your <head>. No crawler quota, no account, and nothing about your site is uploaded.
Browse the 51 tools grouped by what they do.
Generate perfect SEO meta tags, Open Graph and Twitter Card markup with a live Google snippet and social-card preview, copy the ready-to-paste <head> code, 100% in your browser.
Paste a page's HTML to audit its title, description, canonical, robots, Open Graph and Twitter Card tags: with a length score, missing/duplicate checks and a live search & social preview, 100% in your browser.
Write a click-worthy SEO meta description with a live character + pixel meter, a real Google snippet preview and ready-to-edit templates, copy the tag, 100% in your browser.
Type a page title and your brand and see a live Google title preview, desktop and mobile, with exact character and pixel limits and a truncation warning. 100% in your browser.
Build correct Open Graph (og:) meta tags and see a live Facebook and LinkedIn share-card preview as you type, copy the ready-to-paste markup, 100% in your browser.
Generate Twitter Card meta tags for X with a live card preview. Pick summary or large image, set the title, description, image and @handles, then copy the ready-to-paste twitter:* markup. 100% in your browser.
Build a clean rel=canonical tag from any URL: normalise the host, path and query, strip tracking parameters, and copy the ready-to-paste <link> tag, HTTP header and framework snippets, 100% in your browser.
See exactly how your page looks when shared on Facebook, LinkedIn, X, WhatsApp, Telegram, Discord, Slack and Teams, and diagnose why the image, title or preview is wrong or out of date. Paste your HTML for a full, private, in-browser report.
Generate valid JSON-LD structured data for Article, FAQ, Product, Organization, LocalBusiness, Event and more, with a live rich-results validity check and a copy-ready script tag. 100% in your browser.
Turn a list of questions and answers into valid FAQPage JSON-LD structured data, with a live validity check for the Google FAQ rich result and a copy-ready script tag. 100% in your browser.
Generate valid Article, BlogPosting and NewsArticle JSON-LD structured data: with author, publisher, dates, images and keywords, a live SERP preview and a rich-results validity check. 100% in your browser.
Generate valid Product JSON-LD structured data with Offer price, availability and AggregateRating, for price and star-rating rich results in Google. Live validity check, copy-ready script tag, 100% in your browser.
Build valid Organization JSON-LD structured data (name, logo, URL, sameAs social profiles and typed contact points) with a live validity check and a copy-ready script tag. 100% in your browser.
Build valid LocalBusiness JSON-LD structured data (address, geo coordinates, a full opening-hours table, price range and social profiles) with a live validity check and a copy-ready script tag. 100% in your browser.
Generate valid SoftwareApplication JSON-LD for apps, SaaS and games (category, operating system, price and star rating) with a live rich-results validity check and a copy-ready script tag. 100% in your browser.
Generate valid Review JSON-LD structured data (reviewed item, author, star rating and review body) with a live star preview, a required-property check and a copy-ready script tag. 100% in your browser.
Generate valid Person JSON-LD structured data (name, job title, employer, bio and sameAs profile links) with a live validity check and a copy-ready script tag. 100% in your browser.
Generate valid Event JSON-LD structured data (dates, venue or virtual location, organizer, performer and ticket offers) with a live rich-results validity check and a copy-ready script tag. 100% in your browser.
Build valid BreadcrumbList JSON-LD from an ordered trail of pages, with a live Google-style breadcrumb preview, auto-numbered positions and a copy-ready script tag. 100% in your browser.
Generate valid VideoObject JSON-LD structured data (name, thumbnail, upload date, duration and content URL) with a live check for Google video rich results. ISO-8601 duration handled for you, 100% in your browser.
Generate valid Recipe JSON-LD structured data for Google's recipe rich result: ingredients, steps, prep/cook times, yield, nutrition and star ratings, with a live eligibility check and copy-ready script tag. 100% in your browser.
Turn a list of URLs into a valid sitemap.xml with per-URL changefreq, priority and lastmod, validated against the 50,000-URL limit and ready to submit to Google. 100% in your browser.
Turn a list of URLs into a clean, nested HTML sitemap page, a linkable <ul> tree grouped by path that you can paste straight into any site. Boosts internal linking and navigation. 100% in your browser.
Map each page to the images it hosts and generate a valid Google image sitemap (image:image, image:title, image:caption) to get pictures indexed in Google Images. 100% in your browser.
Turn your hosted videos into a Google-valid video sitemap: thumbnail, title, description, player/content URL, duration and publish date per video: validated live and downloadable. 100% in your browser.
Build a valid Google News sitemap from your recent articles (with publication name, language, title and W3C publication date) and get warned about the 48-hour recency window and 1,000-URL cap. 100% in your browser.
Paste your sitemap.xml and validate it instantly: well-formed XML, every <url> has a <loc>, the 50,000-URL limit, HTTPS locations and valid changefreq/priority. Catches the errors that make Google reject a sitemap. 100% in your browser.
Build a valid robots.txt with user-agent groups, allow/disallow rules, crawl-delay, sitemap and host directives, with live output, presets and lint warnings. 100% in your browser.
Paste your robots.txt to parse it into User-agent groups and catch the mistakes that block Google: a stray Disallow: /, rules before any User-agent, unknown directives and a missing sitemap. 100% in your browser.
Preview exactly how your page appears in Google search (desktop and mobile) as you type your title, URL and meta description, with live pixel-width truncation warnings. Nothing is uploaded.
Preview exactly how your link unfurls on Facebook and LinkedIn, paste your page's HTML or type the fields, with a live share card and a plain-English audit of every missing or oversized Open Graph tag. Nothing is uploaded.
Preview exactly how your page will look when shared on X (Twitter), summary and large-image cards, as you type your title, description and image, or paste your page's HTML. Live warnings catch broken cards before you post. Nothing is uploaded.
Paste JSON-LD or a page's HTML to detect schema types, validate required properties, and see which Google rich results your structured data is eligible for, 100% in your browser.
Paste any URL and instantly break it into protocol, host, port, path, every query parameter, hash and origin, with a live rebuilt URL to confirm the parts. 100% in your browser.
Turn any title or text into a clean, SEO-friendly URL slug: pick the separator, case, length and transliteration, and slugify a whole list at once. Copy or download the results, 100% in your browser.
Build clean, correctly-encoded UTM campaign URLs from a form: set source, medium, campaign, term and content, see the live parameter table GA4 reads, then copy or download the tracking link. 100% in your browser.
Build clean, correctly-encoded UTM & campaign tracking URLs with channel presets, custom parameters and a live parameter table, copy the ready-to-share link, 100% in your browser.
Paste HTML and instantly check well-formedness plus on-page SEO (title, meta description, lang, image alt text and heading order) with a live outline. 100% in your browser.
Paste your CSS and instantly catch unbalanced braces, unclosed and empty rules, and unterminated comments or strings, each pinpointed to a line, 100% in your browser.
Paste your JSON-LD structured data to validate it, parse errors, missing @context/@type, and the required & recommended properties each schema.org type needs for rich results, plus a re-formatted copy. 100% in your browser.
Paste JSON-LD or a full HTML page and validate every structured-data block against schema.org, required vs recommended properties, per-@type checks and rich-result notes. 100% in your browser.
Paste your page's HTML and validate its meta tags against SEO best practices: title and description length, canonical, robots, viewport, charset, Open Graph and Twitter completeness: as a graded pass/fail checklist, 100% in your browser.
Paste raw HTTP response headers to parse them into a clean table and get instant notes on status, redirects, caching, compression, cookies, CORS and a graded security-header report, 100% in your browser.
Paste your HTTP response headers and get an instant A–F security grade with per-header pass/warn/fail verdicts and copy-ready fixes for HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, 100% in your browser.
Paste a PEM/X.509 certificate to extract its SHA-1 & SHA-256 fingerprints, DNS names and identity strings, then work through a complete TLS/SSL hardening checklist: 100% in your browser, nothing uploaded.
Build a correct Content-Security-Policy header from a friendly per-directive form (script, style, img, connect, font and frame sources) with a plain-English explanation and a live strictness meter. 100% in your browser.
Paste your HTML to see the full H1–H6 outline as a tree and catch structural problems (missing H1, multiple H1s, skipped levels and empty headings) with a plain-English fix for each. 100% in your browser.
Paste any text to estimate reading time at an adjustable words-per-minute pace, with live word, sentence, paragraph and character stats, 100% in your browser.
Paste text or HTML and see your top keywords and 2- & 3-word phrases with counts and density %, stopwords filtered and keyword-stuffing flagged. 100% in your browser, nothing uploaded.
Count words, characters, sentences, paragraphs and reading time live as you type or paste, with a keyword breakdown and platform length limits. 100% in your browser.
Count characters with and without spaces, plus words, bytes and lines, and check your text live against Twitter/X, meta title, meta description and SMS limits, 100% in your browser.
Field-tested rules of thumb behind every tool here, so the output isn't just valid, it actually ranks.
Keep title tags under ~60 characters so they don't truncate in results, front-load the primary keyword, and make every page's title genuinely unique. A compelling title lifts click-through far more than keyword stuffing ever will.
Google often rewrites it, but a sharp 150–160 character summary with a clear benefit and a soft call-to-action still wins clicks when it does show. Describe the page honestly. Mismatched descriptions get replaced.
Structured data unlocks rich results, but marking up ratings, prices or FAQs that aren't visible on the page risks a manual action. Match your JSON-LD to real, on-page content and validate it before shipping.
A 1200×630 image, a punchy og:title and a one-line og:description control how every share looks on social and chat apps. Set them explicitly instead of letting platforms guess from the first image they find.
List only canonical, indexable URLs in your XML sitemap, point to it from robots.txt, and never disallow a path you also want indexed. Blocking a page in robots.txt stops crawling. It does not reliably remove it from the index.
Duplicate or parameterised URLs split your ranking signals. Pick one canonical version per piece of content, reference it consistently, and let redirects and rel=canonical consolidate the rest.
Tutorials and tips for getting more from our seo studio.
What HTTP security headers do, why they matter for both security and SEO trust, and a plain-English walkthrough of CSP, HSTS, X-Frame-Options, and the other headers worth adding.
Understand robots.txt: how it controls crawlers, the exact syntax for User-agent, Disallow and Allow, common templates, and the mistakes that can deindex your site.
See exactly how your page will look in Google before it goes live: how the title, URL, and meta description render, where they truncate, and how to optimise the whole snippet for clicks.
A practical guide to XML sitemaps: what they do for indexing, the exact structure, what to include and exclude, and how to submit yours to Google Search Console.
A clear comparison of JSON-LD, Microdata, and RDFa for structured data: how each works, why Google recommends JSON-LD, and when the older formats still make sense.
Open Graph tags control how your links look when shared on Facebook, LinkedIn, WhatsApp and Slack. Learn every og: tag, the ideal image size, and how to test them.
Free, private and instant: everything runs in your browser.