Security headers
What are security headers?
Security headers are HTTP response headers that tell the browser how to handle a site’s content more safely. They switch on built-in protections against common attacks such as cross-site scripting, clickjacking and content-type sniffing. They are set on the server, CDN or framework and are invisible to visitors unless something is blocked.
The main ones: `Strict-Transport-Security` (HSTS) forces HTTPS. `Content-Security-Policy` (CSP) limits where scripts, styles and other files can load from. `X-Content-Type-Options: nosniff` stops browsers guessing file types. `X-Frame-Options` or CSP’s `frame-ancestors` stops other sites embedding yours in a frame (clickjacking). `Referrer-Policy` controls how much of the URL is shared with other sites. `Permissions-Policy` limits browser features such as the camera or geolocation.
Why security headers matter for SEO
Security headers are not a Google ranking factor. Their SEO value is indirect but real: hacked sites get injected spam pages, cloaked redirects and malware, which can lead to browser warnings, a manual action for hacked content and a long clean-up. Headers make several common attacks much harder.
They also protect visitors and their data, which protects your brand. Many security reviews and procurement checklists ask for them.
How to add security headers
- Check what you send now with your browser’s developer tools or `curl -I`.
- Add the low-risk headers first: `X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin` and `X-Frame-Options: SAMEORIGIN` (or `frame-ancestors 'self'` in CSP).
- Add HSTS once the whole site works over HTTPS.
- Roll out CSP carefully. Start with `Content-Security-Policy-Report-Only` to see what would be blocked, adjust the policy for your analytics, fonts and embeds, then switch to enforcing.
- Set headers in one place, such as the CDN or server config, so every response gets them, including error pages.
Security headers example
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; img-src 'self' https:; frame-ancestors 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()Security headers FAQ
Do security headers affect SEO?
Not directly; Google does not rank on them. They reduce the risk of the site being hacked and filled with spam, which can cause warnings, manual actions and lost traffic.
Can a Content-Security-Policy break my site?
Yes. A strict CSP blocks any script or style not allowed by the policy, including analytics and embeds. Test it in report-only mode first.
Related SEO terms
HSTS (Strict-Transport-Security)
HSTS is a response header that tells browsers to only connect to a site over HTTPS, so they never load it over insecure HTTP.
HTTPS is the encrypted version of HTTP. It protects data between browser and site, and Google uses it as a lightweight ranking signal.
Mixed content is when an HTTPS page loads images, scripts or other files over insecure HTTP. Browsers block or upgrade much of it.
Hacked content and injected spamBlack hat
Hacked content is spam pages, links or redirects placed on a site without the owner’s permission by exploiting a security hole.
Technical SEO is making sure search engines can crawl, render and index your site, covering speed, redirects, canonicals, sitemaps and mobile.