What is Security headers?
Security headers are HTTP response headers that instruct browsers to enable protections against attacks such as XSS, clickjacking and protocol downgrades.
Security headers are HTTP response headers that tell the browser how to behave when it handles your pages: which scripts may run, whether the page can be framed by another site, whether to always use HTTPS, and how much referrer information to share. They cost nothing to send and block whole classes of attacks that would otherwise rely on browser defaults.
The essential set
| Header | What it protects against |
|---|---|
Strict-Transport-Security | Downgrade to HTTP and SSL stripping (see HSTS (HTTP Strict Transport Security)) |
Content-Security-Policy | Cross-site scripting and injected content, by allowlisting script, style and frame sources |
X-Content-Type-Options: nosniff | Browsers guessing a file’s type and executing it as script |
X-Frame-Options or CSP frame-ancestors | Clickjacking, by controlling who may embed your pages in a frame |
Referrer-Policy | Leaking full URLs, including query strings, to other sites |
Permissions-Policy | Unwanted use of the camera, microphone, geolocation and other browser features |
Cookies need their own flags too: Secure, HttpOnly and SameSite. The OWASP Secure Headers Project and MDN’s CSP guide document recommended values.
A sensible starting point (Nginx)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self' https://www.googletagmanager.com; frame-ancestors 'self'" always;Start CSP in Report-Only mode: the browser reports violations without blocking anything, so you can see which third-party scripts you actually rely on before enforcing the policy.
Do security headers affect SEO?
Not directly — none of them is a ranking factor. Their value for search is protective. A hacked site can be injected with spam links, cloaked pages or malicious redirects; Google may then show a “This site may be hacked” notice in results or flag the site in Search Console’s Security issues report, and browsers can display full-page warnings. Headers like CSP make many of those injections much harder. They also complete a trustworthy HTTPS setup, which users and partners increasingly check before linking to or integrating with a site.
Common mistakes
- Enforcing a strict CSP on day one and silently breaking analytics, tag managers, embedded videos or payment widgets.
- Still sending
X-XSS-Protection. It’s deprecated; modern browsers ignore it and the old filter could itself cause issues. Rely on CSP instead. - Setting headers on the HTML only and forgetting error pages, redirects or a CDN that strips them. Nginx’s
alwaysparameter helps. Referrer-Policy: no-referrersite-wide, which hides your site in partners’ referral analytics.strict-origin-when-cross-originis a balanced default.
How to check
The Security Headers Checker grades a URL from A+ to F on Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and cookie flags, then gives copy-paste fixes for Apache, Nginx and Cloudflare. Check your SSL certificate at the same time.
Frequently asked questions
Are security headers a Google ranking factor?
No. Google does not rank pages by security headers. They help indirectly by making hacks, spam injection and malicious redirects harder, all of which can damage visibility and trust.
Which security header should I add first?
Start with Strict-Transport-Security, X-Content-Type-Options and Referrer-Policy, which rarely break anything. Add Content-Security-Policy in report-only mode, then enforce it once you know which sources your pages need.