The headers that matter
| Header | What it protects against |
|---|---|
| Strict-Transport-Security | Downgrade attacks; forces HTTPS |
| Content-Security-Policy | Injected scripts (XSS) and unwanted third-party code |
| X-Frame-Options or frame-ancestors | Clickjacking through hidden frames |
| X-Content-Type-Options | Browsers misreading files as scripts |
| Referrer-Policy | Leaking private URLs to other sites |
| Permissions-Policy | Unused access to camera, microphone and location |
Why it matters for SEO
Hacked sites get spam pages injected, lose rankings and can be flagged in search results. Security headers are a cheap layer of protection, and they show buyers and partners that a site is well run.
How to add them
- Cloudflare: use Transform Rules or a Worker to add headers to every response.
- WordPress: a security plugin or your host's settings.
- Shopify: Shopify sets HTTPS and some headers for you; others aren't configurable.
- Custom sites: set them in your web server or framework config.
Start with a Content-Security-Policy in report-only mode, so you can see what it would block before enforcing it.