HTTP security headers
Response headers such as HSTS and X-Content-Type-Options are usually set once at the CDN or origin for the whole site. SEO Perception checks a small set of common headers on the homepage crawl only and, when any are missing, opens one site-wide possibility—not a repeated row on every URL.
What we look for
- Strict-Transport-Security (HSTS) — present on the response.
- X-Content-Type-Options — value includes
nosniff. - Clickjacking protection —
X-Frame-Optionsis set, or Content-Security-Policy includesframe-ancestors. - Referrer-Policy — present on the response.
This is a lightweight presence check for site hygiene. It is not a full security audit, grade, or compliance claim.
What to do
Configure the missing headers at your host, CDN, or reverse proxy so they apply site-wide. After you deploy the change, re-crawl the homepage so the possibility can clear.
Example
Typical values (tune to your stack):
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Alternatively, CSP can supply clickjacking protection with a frame-ancestors directive instead of X-Frame-Options.
Technical details
We read headers from the live homepage response during crawl and do not store a full header bag on every page. Path-specific header setups that differ from the homepage will not appear in this check.