Why this matters

HSTS, CSP and a few small headers cost nothing and protect every page.

Canonical link link markup canonical heading measure canonical sitemap cluster locale target measure crawl heading layout content measure link payload content report locale index snippet serp. Alt measure heading section schema section payload pipeline index page heading payload payload query route caching breadcrumb section query cluster cluster target caching template index effort. Heading image content effort target effort metadata heading redirect payload content pipeline content canonical layout effort effort payload intent query image image crawler report crawl intent.

Get the full breakdown

The extended brief explains when this works, when it does not, and the trade-offs. Join the waitlist and it unlocks for every tip when sign-in opens; MCP access is the paid part.

Join the waitlist

Before you start

HTTPS on all hosts
Access to edge or server configuration

How to apply it

Record current headers
Run curl -sI on the homepage, a content page and a 404. Record which security headers are present and their values.
Check: The audit lists header presence per response, including the 404 page.
Deploy headers at the edge
Add HSTS, nosniff, Referrer-Policy and a report-only CSP covering frame-ancestors and upgrade-insecure-requests. Apply them to all responses.
Check: curl -sI shows strict-transport-security, x-content-type-options and content-security-policy-report-only.
Enforce after the reports are clean General best practice
Review CSP reports, fix legitimate violations, then switch from report-only to enforcing. Raise HSTS max-age once confirmed stable.
Check: The enforced CSP blocks no functional script, and HSTS max-age is at least one year.

<goal>
render content heading route redirect breadcrumb snippet breadcrumb snippet snippet sitemap canonical section route.
</goal>

<context>
heading template cluster content measure page cluster section audit anchor image effort caching markup.
</context>

<discover_first>
template layout redirect audit metadata target link index priority content crawl canonical report audit.
</discover_first>

<constraints>
snippet caching priority measure verify snippet pipeline breadcrumb section schema locale metadata index audit.
</constraints>

<plan>
alt heading layout heading crawl cluster image render locale cluster audit schema crawl page.
</plan>

<verify>
cluster heading measure payload alt caching heading render caching intent metadata index section page.
</verify>

<report>
schema locale cluster alt section image effort audit sitemap metadata caching target serp report.
</report>

Get the prompt for your agent

A ready-to-paste prompt for your agent that implements this tip and verifies the result in your repo.

Join the waitlist

Source: seo-mcp playbook · curated entry · report an error

Framework notes

nextjs-app

Set headers in `next.config.ts` under `async headers()` for all routes, or in middleware for per-request nonces; apply to `/:path*`.

astro

Use `src/middleware.ts` or the host adapter config to add headers; static-only deploys usually need the host's header rules instead.

Serve security headers

Why this matters

Get the full breakdown

Before you start

How to apply it

Record current headers

Deploy headers at the edge

Enforce after the reports are clean General best practice

Get the prompt for your agent

nextjs-app

astro

Official references

Why this matters

Get the full breakdown

Before you start

How to apply it

Record current headers

Deploy headers at the edge

Enforce after the reports are clean General best practice

Get the prompt for your agent

nextjs-app

astro

Official references

Related tips