Skip to content
SEO Tools
Help and documentation
Security High impact Medium 30–60 min

Site security

HTTPS, security headers, and protecting visitors.

What it is

Site security includes HTTPS, security HTTP headers (HSTS, X-Content-Type-Options, X-Frame-Options, CSP), and protection against common attacks.

Why it matters

An insecure site endangers visitors and your brand, and Google disadvantages it. Security headers prevent attacks such as clickjacking, MIME sniffing, or script injection.

How to do it

  1. 1Have valid HTTPS and enforce it (HSTS).
  2. 2Set X-Content-Type-Options: nosniff and X-Frame-Options (or CSP frame-ancestors).
  3. 3Consider a Content-Security-Policy against XSS.
  4. 4Keep your CMS, libraries, and plugins updated.

Basic security headers

Correct
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN

Conclusion

Security is trust. Start with HTTPS + HSTS and the basic headers (a quick win), and add CSP judiciously (it can break a page, so deploy it gradually). Keeping the system updated is an ongoing given.

Related topics