The Complete Guide to Security Headers for SEO and Trust

Security headers are HTTP response headers that protect your site from attacks and signal to browsers (and search engines) that your site takes security seriously. While not a direct ranking factor, they contribute to the trust and safety signals that Google evaluates as part of E-E-A-T.

Why Security Headers Matter for SEO

Security headers don’t directly boost rankings, but they indirectly affect SEO through:

• User trust. Sites that get hacked or display browser warnings lose visitors permanently.
• Data integrity. Headers like CSP prevent content injection that could alter your pages.
• HTTPS enforcement. HSTS ensures browsers always use HTTPS, which is a ranking signal.
• Clickjacking prevention. X-Frame-Options stops your content from being embedded on malicious sites.

The Essential Security Headers

1. Strict-Transport-Security (HSTS)

Forces browsers to use HTTPS for all requests to your domain.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

• max-age=31536000 — Remember for 1 year
• includeSubDomains — Apply to all subdomains
• preload — Request inclusion in browsers’ built-in HSTS preload list

SEO impact: Eliminates HTTP-to-HTTPS redirects on repeat visits, improving page load times. Ensures all traffic is encrypted.

2. Content-Security-Policy (CSP)

Controls which resources (scripts, styles, images) can load on your page. Prevents cross-site scripting (XSS) attacks.

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:

Start with report-only mode to avoid accidentally breaking your site:

Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-report

SEO impact: Prevents attackers from injecting malicious scripts that could redirect users, display spam, or trigger Google’s “hacked site” warning.

3. X-Content-Type-Options

Prevents browsers from MIME-type sniffing, which can lead to security vulnerabilities.

X-Content-Type-Options: nosniff

Always set this. There’s no downside.

4. X-Frame-Options

Controls whether your site can be embedded in iframes on other sites.

X-Frame-Options: SAMEORIGIN

Options:

• DENY — Never allow framing
• SAMEORIGIN — Only allow framing by your own domain

SEO impact: Prevents clickjacking attacks where malicious sites overlay your content with invisible elements.

5. Referrer-Policy

Controls how much referrer information is sent when users click links on your site.

Referrer-Policy: strict-origin-when-cross-origin

This sends the full URL for same-origin requests but only the origin (domain) for cross-origin requests. Good balance between analytics functionality and privacy.

6. Permissions-Policy

Controls which browser features (camera, microphone, geolocation) your site can use.

Permissions-Policy: camera=(), microphone=(), geolocation=()

The empty parentheses () disable these features entirely. Only enable features your site actually needs.

How to Set Security Headers

Cloudflare (Managed Rules or Workers)

// Cloudflare Worker
addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request));
});

async function handleRequest(request) {
  const response = await fetch(request);
  const newHeaders = new Headers(response.headers);

  newHeaders.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  newHeaders.set('X-Content-Type-Options', 'nosniff');
  newHeaders.set('X-Frame-Options', 'SAMEORIGIN');
  newHeaders.set('Referrer-Policy', 'strict-origin-when-cross-origin');

  return new Response(response.body, {
    status: response.status,
    headers: newHeaders
  });
}

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache (.htaccess)

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

Vercel (vercel.json)

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "X-Content-Type-Options", "value": "nosniff" },
        { "key": "X-Frame-Options", "value": "SAMEORIGIN" },
        { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }
      ]
    }
  ]
}

Common Mistakes

1. Not setting any security headers. Many sites have zero security headers — every header you add is an improvement.
2. Overly restrictive CSP that breaks the site. Always test CSP in report-only mode first.
3. Setting HSTS without HTTPS fully working. If your HTTPS setup has issues, HSTS will lock users out of your site.
4. Forgetting about subdomains. HSTS with includeSubDomains requires all subdomains to support HTTPS.

How Do I Check My Security Headers?

What seoutils.dev checks: Our free audit evaluates your HTTPS enforcement, HSTS header, and other security-related configurations that contribute to your site’s trust profile.

Run a free audit to check your security headers.

---

This is part of our Complete SEO Audit Checklist. Related: SSL Certificate and SEO | Trust Pages and E-E-A-T.