Fix library · Security
Four headers worth asking your host about
These four are grouped together because they are the same kind of task: a line your server sends with every response, added once, invisible afterwards. None of them is urgent and none will change your rankings. Two take a minute, one needs care, and on a hosted platform there may be nothing for you to do at all.
HSTS: always use the secure version
What SEOPert detected
Your site does not send the Strict-Transport-Security header.
What this means
HSTS tells browsers to always use the secure version of your site. It is a low-priority hardening step.
How to fix it
- Once HTTPS works on every page, ask your host or developer to add the Strict-Transport-Security header, starting with a short duration.
On Shopify, Wix, Squarespace and Webflow
- Your platform manages its own server settings and does not let you add custom security headers.
- This is a low-priority item: there is nothing to fix on your side. You can ignore it.
If you are handing this to a developer
Add Strict-Transport-Security: max-age=300 first, then raise to 31536000 once confirmed.
Check it worked. Check your homepage at securityheaders.com: Strict-Transport-Security should be listed.
Content Security Policy: limit what can run
What SEOPert detected
Your site does not send a Content-Security-Policy header.
What this means
A Content Security Policy limits what code can run on your site, reducing damage from injected scripts. It is an advanced, low-priority step.
How to fix it
- Ask your developer to add a Content-Security-Policy that allows only the services your site uses. Test carefully: a wrong policy can break parts of the site.
On Shopify, Wix, Squarespace and Webflow
- Your platform manages its own server settings and does not let you add custom security headers.
- This is a low-priority item: there is nothing to fix on your side. You can ignore it.
If you are handing this to a developer
Add a restrictive Content-Security-Policy header tailored to the site’s actual script, style, image and frame sources.
Check it worked. Check your homepage at securityheaders.com: Content-Security-Policy should be listed, and the site should still work normally.
nosniff: stop browsers guessing file types
What SEOPert detected
Your site does not send the X-Content-Type-Options header.
What this means
This header stops browsers from guessing file types, which closes a class of attacks. It is a quick, low-priority fix.
How to fix it
- Ask your host or developer to add the header “X-Content-Type-Options: nosniff”.
On Shopify, Wix, Squarespace and Webflow
- Your platform manages its own server settings and does not let you add custom security headers.
- This is a low-priority item: there is nothing to fix on your side. You can ignore it.
If you are handing this to a developer
Send X-Content-Type-Options: nosniff on all responses (e.g. Header always set X-Content-Type-Options "nosniff" in .htaccess).
Check it worked. Check your homepage at securityheaders.com: X-Content-Type-Options should be listed.
Referrer-Policy: limit what you leak to other sites
What SEOPert detected
Your site does not send a Referrer-Policy header.
What this means
A referrer policy limits how much of your page addresses are shared with other websites. It is a low-priority privacy step.
How to fix it
- Ask your host or developer to add “Referrer-Policy: strict-origin-when-cross-origin”.
On Shopify, Wix, Squarespace and Webflow
- Your platform manages its own server settings and does not let you add custom security headers.
- This is a low-priority item: there is nothing to fix on your side. You can ignore it.
If you are handing this to a developer
Send Referrer-Policy: strict-origin-when-cross-origin.
Check it worked. Check your homepage at securityheaders.com: Referrer-Policy should be listed.
Related
Check your own site
See which of these apply to you.
The free audit checks up to 10 pages and tells you exactly what it found, in the same plain language as these guides. No account, no card.