Security Headers
HTTP headers that protect your site from XSS, clickjacking, and other web attacks.
Security headers are HTTP response headers that instruct the browser to enforce protections — Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy and a framing policy. They cost nothing to add and mitigate whole classes of attack, which is why audits check for them.
Definition
Security headers are HTTP response headers that protect against common web attacks. Key headers include: Content-Security-Policy (prevents XSS), X-Frame-Options (prevents clickjacking), X-Content-Type-Options (prevents MIME sniffing), Referrer-Policy (controls referrer data), and Permissions-Policy (restricts browser APIs).
Why It Matters
Security headers are a signal of site quality and trustworthiness. Google considers security as part of page experience. Missing security headers can also lead to your site being hacked and deindexed.
Example
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=()Related Terms
Related Tools
Know the term.
Check your own site.
A free audit tells you whether this is currently costing you score points — and exactly what to change.
Run a free audit