Security headers missing

Low priorityTechnical

The site doesn’t send some of the main HTTP security headers: Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or Referrer-Policy.

What triggers this issue

• No Content-Security-Policy header.
• No X-Content-Type-Options: nosniff.
• No clickjacking protection: neither X-Frame-Options nor a CSP frame-ancestors directive.
• No Referrer-Policy header.

Why it matters

These headers tell browsers how to protect your visitors: which scripts may run, not to guess file types, not to let other sites frame your pages, and how much of your URLs to share with other sites.

They aren’t ranking factors, but a compromised site loses rankings and trust quickly, and security scanners and some clients check for them.

How to fix it

1. Add X-Content-Type-Options, X-Frame-Options and Referrer-Policy first; they’re safe for almost every site.
2. Roll out Content-Security-Policy in Content-Security-Policy-Report-Only mode, fix what it reports, then enforce it.
3. Set headers in your server, CDN (_headers on Netlify or Cloudflare Pages, vercel.json on Vercel) or framework config.

X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'