Run an audit

Fix library · Security

Four headers worth asking your host about

These four are grouped together because they are the same kind of task: a line your server sends with every response, added once, invisible afterwards. None of them is urgent and none will change your rankings. Two take a minute, one needs care, and on a hosted platform there may be nothing for you to do at all.

Security Low at worst 4 findings covered

Low

HSTS: always use the secure version

What SEOPert detected

Your site does not send the Strict-Transport-Security header.

What this means

HSTS tells browsers to always use the secure version of your site. It is a low-priority hardening step.

How to fix it

  1. Once HTTPS works on every page, ask your host or developer to add the Strict-Transport-Security header, starting with a short duration.
On Shopify, Wix, Squarespace and Webflow
  1. Your platform manages its own server settings and does not let you add custom security headers.
  2. This is a low-priority item: there is nothing to fix on your side. You can ignore it.

If you are handing this to a developer

Add Strict-Transport-Security: max-age=300 first, then raise to 31536000 once confirmed.

Check it worked. Check your homepage at securityheaders.com: Strict-Transport-Security should be listed.

Low

Content Security Policy: limit what can run

What SEOPert detected

Your site does not send a Content-Security-Policy header.

What this means

A Content Security Policy limits what code can run on your site, reducing damage from injected scripts. It is an advanced, low-priority step.

How to fix it

  1. Ask your developer to add a Content-Security-Policy that allows only the services your site uses. Test carefully: a wrong policy can break parts of the site.
On Shopify, Wix, Squarespace and Webflow
  1. Your platform manages its own server settings and does not let you add custom security headers.
  2. This is a low-priority item: there is nothing to fix on your side. You can ignore it.

If you are handing this to a developer

Add a restrictive Content-Security-Policy header tailored to the site’s actual script, style, image and frame sources.

Check it worked. Check your homepage at securityheaders.com: Content-Security-Policy should be listed, and the site should still work normally.

Low

nosniff: stop browsers guessing file types

What SEOPert detected

Your site does not send the X-Content-Type-Options header.

What this means

This header stops browsers from guessing file types, which closes a class of attacks. It is a quick, low-priority fix.

How to fix it

  1. Ask your host or developer to add the header “X-Content-Type-Options: nosniff”.
On Shopify, Wix, Squarespace and Webflow
  1. Your platform manages its own server settings and does not let you add custom security headers.
  2. This is a low-priority item: there is nothing to fix on your side. You can ignore it.

If you are handing this to a developer

Send X-Content-Type-Options: nosniff on all responses (e.g. Header always set X-Content-Type-Options "nosniff" in .htaccess).

Check it worked. Check your homepage at securityheaders.com: X-Content-Type-Options should be listed.

Low

Referrer-Policy: limit what you leak to other sites

What SEOPert detected

Your site does not send a Referrer-Policy header.

What this means

A referrer policy limits how much of your page addresses are shared with other websites. It is a low-priority privacy step.

How to fix it

  1. Ask your host or developer to add “Referrer-Policy: strict-origin-when-cross-origin”.
On Shopify, Wix, Squarespace and Webflow
  1. Your platform manages its own server settings and does not let you add custom security headers.
  2. This is a low-priority item: there is nothing to fix on your side. You can ignore it.

If you are handing this to a developer

Send Referrer-Policy: strict-origin-when-cross-origin.

Check it worked. Check your homepage at securityheaders.com: Referrer-Policy should be listed.

Find the header that gives too much away A 30-second exercise. One line is the problem — see whether you would catch it.

Related

Read next

HTTPS: the padlock, and why browsers insist on it Security Sending every visitor to the secure version Security Secure pages loading insecure files Security

Check your own site

See which of these apply to you.

The free audit checks up to 10 pages and tells you exactly what it found, in the same plain language as these guides. No account, no card.

Free · No account · Results in under a minute · Public websites only