Security headers that protect your site and visitors

Security headers are instructions your server sends with every page. They do not boost rankings directly, but they protect visitors and your reputation, and a hacked site loses rankings fast.

The main ones

• Strict-Transport-Security (HSTS): always use HTTPS. HSTS checker.
• Content-Security-Policy: which sources may load scripts and styles. CSP checker.
• X-Frame-Options or CSP frame-ancestors: stops other sites framing your pages (clickjacking).
• X-Content-Type-Options: nosniff.
• Referrer-Policy: how much of your address is shared when visitors leave. Referrer policy checker.

Check them all

The security headers checker grades a page. Also hide version numbers in the Server header: the server signature checker shows what you reveal.

Start safely with CSP

Content-Security-Policy is powerful but easy to get wrong: a strict policy can break scripts and styles. Start in report-only mode, collect what would be blocked, then tighten the policy step by step.

Example headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin

Where to set them

In your web server configuration (Apache, Nginx), your CDN, or your application. Setting them in one place avoids conflicts.

Keep software updated

Headers reduce risk, but most hacks come through outdated software, weak passwords and vulnerable plugins. Updates and strong passwords matter just as much.