Security headers are response headers that browsers enforce: they reduce clickjacking, mixed content, and protocol downgrade risk. They also show up as trust and technical checks in modern site audits.
SEOHub flags missing HSTS, weak or absent Content-Security-Policy, missing X-Frame-Options (or frame-ancestors), and related baseline headers during homepage and full-site scans. Failures often vary by route when a CDN and an origin app disagree.
Enable HSTS only once HTTPS is solid across the whole host. When ready, add includeSubDomains — and understand that pinning browsers to HTTPS is hard to undo, so test staging first.
Start CSP in report-only, then tighten script-src and object-src until you can enforce. A sudden enforce mode with 'unsafe-inline' removed can break analytics and widgets overnight.
Set X-Frame-Options or CSP frame-ancestors, Referrer-Policy, and Permissions-Policy as a baseline even if you are not chasing a perfect A+ score on every scanner.
Inspect live responses with the free HTTP headers tool on key templates: home, app routes, and static asset hosts if they are separate.
After CDN or host changes, re-scan — SEOHub will show whether HSTS and CSP still appear on the URLs that matter, not just on a single marketing homepage cached elsewhere.
Align headers with redirects. If http:// still serves content without redirecting, HSTS on https:// alone leaves a gap; fix the redirect chain first.
Document exceptions (payment iframes, third-party embeds) in the CSP so future engineers do not “fix” security by deleting the policy.
Treat report-uri / report-to noise as a backlog, not a reason to disable CSP. Tighten gradually using real violation reports.
Marketing sites and app shells may need different policies. Prefer shared defaults at the edge with path overrides over copy-pasted nginx snippets that drift.
When the checklist is green, keep a quarterly headers check in your deploy notes — theme and plugin updates are a common way CSP quietly disappears.