Learn
Security Headers: What Each One Does and What It Costs
Security headers do not improve rankings. One of them can silently break your page for everyone, which is the real reason to understand them before deploying them.
Run a fresh DomainLens audit and use the report as your priority list.
The headers worth setting
Two of these are free to deploy and two can take your site down. Start with the harmless ones, and treat CSP and HSTS as projects rather than one-line additions.
| Header | Protects against | Risk of breaking things |
|---|---|---|
| Strict-Transport-Security | Downgrade to HTTP | High — hard to undo |
| Content-Security-Policy | XSS and injection | Very high if misconfigured |
| X-Content-Type-Options | MIME sniffing | None |
| X-Frame-Options | Clickjacking | Low — blocks legitimate embeds |
| Referrer-Policy | Leaking URLs to third parties | Low — can break analytics |
| Permissions-Policy | Unwanted API access | Low |
Do security headers affect SEO?
Not as ranking signals. Google does not check whether you send X-Content-Type-Options and does not reward you for it. Any article claiming security headers are a ranking factor is describing a correlation between well-run sites and good headers.
They matter for SEO in exactly one indirect way: a misconfigured CSP can block the scripts a page needs to render, so Googlebot receives a broken page. That is a rendering failure with a security header as its cause, not a ranking effect.
HSTS is a commitment, not a setting
Strict-Transport-Security tells browsers to refuse HTTP for this host for the stated duration. That is genuinely useful — it removes the redirect hop and closes a downgrade attack — and it is close to irreversible while the max-age lasts.
A browser that has seen the header will not connect over HTTP even if your certificate expires and even if you remove the header. Ship a one-year max-age with an expired certificate and the site is unreachable for that browser until either is fixed.
# Start short while you confirm nothing breaks
Strict-Transport-Security: max-age=300
# Then raise it once you are confident
Strict-Transport-Security: max-age=31536000
# Only add subdomains once every one of them
# serves valid HTTPS — this catches internal tools
Strict-Transport-Security: max-age=31536000; includeSubDomains
# preload submits you to a browser-shipped list.
# Removal takes months. Do not add it casually.
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadCSP is where sites break
A Content-Security-Policy lists which sources may load scripts, styles, images and frames. Get it wrong and the browser blocks your own assets, so the page renders without its JavaScript or CSS — for users and for Googlebot alike.
The safe path is report-only mode. The browser reports what the policy would have blocked without blocking anything, so you discover the third-party script you forgot before it takes the site down.
# Observe, do not enforce
Content-Security-Policy-Report-Only:
default-src 'self';
script-src 'self' https://www.googletagmanager.com;
report-uri /csp-report
# Read the reports for a week, add what is missing,
# then switch the header name to enforce it.
# 'unsafe-inline' in script-src defeats most of the
# protection — if you need it, the policy is not
# yet doing what you think it is.A sensible starting set
Set these at the server or CDN so they apply everywhere, and remember that in nginx a location-level add_header discards inherited ones rather than adding to them. See nginx for SEO for that trap, and mixed content for the HTTPS problems headers cannot fix.
- X-Content-Type-Options: nosniff — no downside, deploy immediately.
- Referrer-Policy: strict-origin-when-cross-origin — a good default that keeps analytics working.
- X-Frame-Options: SAMEORIGIN, unless you deliberately allow embedding.
- Strict-Transport-Security with a short max-age, raised over time.
- Content-Security-Policy in report-only mode, enforced only after the reports are clean.
How DomainLens contributes
DomainLens reports which security headers a URL returns, alongside the caching and compression headers, so a policy that was configured but never reached production is visible. Check any URL directly with the HTTP headers checker .
- Do security headers improve SEO?
- No. They are not ranking signals. The only SEO connection is negative: a broken CSP can stop a page rendering for Googlebot.
- Is HSTS safe to enable?
- Yes, with a short max-age at first. It is close to irreversible while active, so a long duration plus a certificate failure means browsers refuse to connect at all.
- Why did my site break after adding CSP?
- The policy blocked assets you did not account for. Deploy in report-only mode, read the reports, and enforce only once they are clean.
- Should I use the preload directive with HSTS?
- Only when you are certain every subdomain serves valid HTTPS permanently. Removal from the browser preload list takes months.