Security headers

Security headers protect visitors from common attacks like XSS, clickjacking and man-in-the-middle. Google prefers secure sites and poor security can damage visitor trust.

Add the following headers to your server responses: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy. Test via securityheaders.com.

This check scores from 0 to 100. Below 50 is a fail, 50 to 89 is a warning, 90 or above is good. After each crawl you see the score per page in your report, with a short note on what we found.

Frequently asked questions

Example

Copy the code below and adapt the domain name, brand name and content to your situation.

# Nginx: security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

# Apache .htaccess
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Frame-Options "DENY"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Validate via: https://securityheaders.com