New

MCP: talk to your Google Search Console data and SEO analysis in Cursor, Claude, and other AI tools.

See MCP

Start here

Search all docs
Browse all topics

HTTP security headers

Response headers such as HSTS and X-Content-Type-Options are usually set once at the CDN or origin for the whole site. SEO Perception checks a small set of common headers on the homepage crawl only and, when any are missing, opens one site-wide possibility—not a repeated row on every URL.

What we look for

  • Strict-Transport-Security (HSTS) — present on the response.
  • X-Content-Type-Options — value includes nosniff.
  • Clickjacking protection — X-Frame-Options is set, or Content-Security-Policy includes frame-ancestors.
  • Referrer-Policy — present on the response.

This is a lightweight presence check for site hygiene. It is not a full security audit, grade, or compliance claim.

What to do

Configure the missing headers at your host, CDN, or reverse proxy so they apply site-wide. After you deploy the change, re-crawl the homepage so the possibility can clear.

Example

Typical values (tune to your stack): 

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin

Alternatively, CSP can supply clickjacking protection with a frame-ancestors directive instead of X-Frame-Options.

Technical details

We read headers from the live homepage response during crawl and do not store a full header bag on every page. Path-specific header setups that differ from the homepage will not appear in this check.