Fix guide

How to add security headers (HSTS, CSP and more)

About 3 min read Time to do it: 45 min Updated
Quick answerSecurity headers instruct browsers to behave more safely. Review what is missing, add headers one at a time and test that your site still works.
On this page
  1. Is this your problem?
  2. Why this matters for SEO
  3. Common causes
  4. Step-by-step fix
  5. How to confirm it worked
  6. Mistakes to avoid
  7. Tools to use
  8. FAQ
  9. Related guides

Why this matters for SEO

Security headers instruct browsers to behave more safely. Review what is missing, add headers one at a time and test that your site still works.

Search visibility depends on several systems agreeing: the page must be reachable, discoverable, technically eligible to be indexed, useful for the query, and supported by a clear internal site structure. Fixing one symptom while another system is blocking the page can produce little or no improvement.

Use this guide as a focused workflow rather than a checklist to complete blindly. Confirm the actual page and response first, make the smallest defensible change, then re-test the same evidence after deployment.

Is this your problem?

  • The Security Headers Checker reports missing headers.
  • You want to harden a site after a launch.

Common causes

  • Defaults of the host or CMS do not set headers.
  • A header exists but is weakly configured.
Diagnosis order

Check access and HTTP status first, then robots and indexability directives, canonicalization, content/template quality, internal links and performance. This order prevents a low-priority content edit from hiding a technical blocker.

Step-by-step fix

  1. Run the report

    Enter your URL in the Security Headers Checker and note missing or weak headers.

  2. Start with low-risk headers

    Add X-Content-Type-Options: nosniff, a Referrer-Policy and a Permissions-Policy suited to your site.

  3. Enable HSTS carefully

    Set Strict-Transport-Security only when the whole site works on HTTPS, starting with a short max-age.

  4. Roll out CSP gradually

    A Content-Security-Policy can break scripts and styles. Test in report-only mode first.

  5. Handle framing

    Use frame-ancestors in CSP or X-Frame-Options to control embedding.

  6. Re-test

    Run the checker again and click through key pages and forms.

How to confirm it worked

The report shows the headers you intended and the site functions normally.

Verification should use the same URL and comparable conditions as the original test. Check the HTTP response, rendered/source markup and the relevant Google Search Console report where applicable. A successful technical change does not guarantee immediate indexing; crawling and indexing can take time and Google may still choose not to index a page it considers redundant or low quality.

Mistakes to avoid

  • Enabling a strict CSP without testing.
  • Setting a long HSTS max-age before HTTPS is fully working.

Tools to use

Security Headers Checker
SSL Certificate Checker

FAQ

Where do I set headers?

In your web server configuration, CDN or application. Ask your host if unsure.

Are headers a ranking factor?

Not directly, but they improve safety and trust for visitors.

Check your own site now. The free SeOMeter tools run these checks on your own URLs, no sign-up needed.

Open the SEO tools

Was something unclear or out of date? Tell us and we will improve this guide. SEO checks are diagnostic guidance, not a promise of rankings, traffic or indexing.