Security Headers: The Response Headers Search Engines and Users Both See
HSTS, CSP, X-Frame-Options and the rest. What each response header protects against, why search visibility depends on it, and how to add them in one place.
Security headers are a small set of response-header directives that decide what a browser will allow on your pages. They cost nothing to add, apply site-wide, and are visible to anyone who inspects a response, including the people evaluating whether your site is trustworthy. Their value is concrete. HSTS removes the plaintext first request that makes downgrade attacks possible. A Content-Security-Policy limits which origins may execute scripts, containing an injected script rather than letting it read every page it lands on. X-Frame-Options and frame-ancestors stop your pages being framed by a site that overlays its own controls on yours. X-Content-Type-Options stops a browser guessing that an uploaded file is executable JavaScript. Referrer-Policy and Permissions-Policy control what leaves the page: which URLs travel in the Referer header, and which device APIs embedded content may request. The search connection is indirect and real. A site compromised through an injected script starts serving pages that are not yours, and search engines act on that quickly, first with warnings in results and then with removal. Recovery takes far longer than the configuration would have. These checks read the headers on your homepage response. Most sites can add every one of them in a single change at the edge.
HSTS header missing
Why it matters
Security headers protect your visitors from script injection and click-hijacking, and their absence is visible to anyone who inspects the site.
How we check it
The Strict-Transport-Security header was checked in the homepage response.
How to fix it
Add the Strict-Transport-Security header: 'max-age=63072000; includeSubDomains'. Why this matters: HSTS prevents downgrade attacks where an attacker forces your site to load over insecure HTTP, and it is required for HSTS preload list inclusion.
CSP header missing
Why it matters
Without a Content-Security-Policy, an injected script runs with full access to the page and everyone viewing it.
How we check it
The Content-Security-Policy header was checked in the homepage response.
How to fix it
Add a Content-Security-Policy header to restrict script and resource loading sources. Why this matters: CSP is your primary defense against XSS attacks—it prevents malicious scripts from executing even if an attacker injects them into your page.
X-Frame-Options missing
Why it matters
Without frame protection, another site can embed your pages invisibly and trick visitors into clicking things they cannot see.
How we check it
The X-Frame-Options header was checked for clickjacking protection.
How to fix it
Add 'X-Frame-Options: DENY' or 'SAMEORIGIN' to prevent clickjacking. Why this matters: Without this, attackers can embed your site in a hidden iframe and trick users into clicking buttons they can't see, potentially compromising accounts or actions.
X-Content-Type-Options missing
How we check it
The X-Content-Type-Options header was checked for MIME-sniffing protection.
How to fix it
Add 'X-Content-Type-Options: nosniff' to prevent MIME type sniffing. Why this matters: Browsers may incorrectly guess a file's content type and execute it as script, creating an injection vector for uploaded files and unexpected responses.
Referrer-Policy missing
Why it matters
Without a Referrer-Policy, full URLs — including any sensitive parameters — can leak to the third-party sites your pages link to.
How we check it
The Referrer-Policy header was checked for privacy control.
How to fix it
Add a Referrer-Policy header (e.g., 'strict-origin-when-cross-origin'). Why this matters: Without it, full URLs containing sensitive parameters or user identifiers may leak to third-party sites through the Referer header.
Permissions-Policy missing
Why it matters
Without a Permissions-Policy, third-party scripts on the page can request powerful browser features like camera, microphone, and location.
How we check it
The Permissions-Policy header was checked for feature restriction.
How to fix it
Add a Permissions-Policy header to restrict browser feature access. Why this matters: This prevents malicious or compromised third-party scripts from accessing sensitive APIs like camera, microphone, geolocation, and clipboard without explicit permission.
Cross-origin isolation not configured
How we check it
Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers were checked.
How to fix it
Configure COOP/COEP only when the site needs advanced cross-origin-isolated browser capabilities. These optional headers are not an SEO requirement.
See How Your Site Ranks
Get a free AI-powered SEO report with actionable findings and priority fixes for your website.
No signup required.