---
title: "Serve security headers"
description: "Security headers reduce injection, clickjacking and downgrade risk. Send HSTS with a long max-age, a Content-Security-Policy in report-only mode first, X-Content-Type-Options nosniff, a Referrer-Policy and frame-ancestors. Verify with curl headers on the production host before you enforce the policy."
url: "https://seo-mcp.io/t/serve-security-headers"
---

# Serve security headers

Security headers reduce injection, clickjacking and downgrade risk. Send HSTS with a long max-age, a Content-Security-Policy in report-only mode first, X-Content-Type-Options nosniff, a Referrer-Policy and frame-ancestors. Verify with curl headers on the production host before you enforce the policy.

## Prerequisites

- HTTPS on all hosts
- Access to edge or server configuration

## Steps

1. **Record current headers** — Run curl -sI on the homepage, a content page and a 404. Record which security headers are present and their values.
   Check: The audit lists header presence per response, including the 404 page.
2. **Deploy headers at the edge** — Add HSTS, nosniff, Referrer-Policy and a report-only CSP covering frame-ancestors and upgrade-insecure-requests. Apply them to all responses.
   Check: curl -sI shows strict-transport-security, x-content-type-options and content-security-policy-report-only.
3. **Enforce after the reports are clean** *(general best practice)* — Review CSP reports, fix legitimate violations, then switch from report-only to enforcing. Raise HSTS max-age once confirmed stable.
   Check: The enforced CSP blocks no functional script, and HSTS max-age is at least one year.

## Source

@seo-mcp on 2026-10-19: https://web.dev/articles/security-headers

Canonical: https://seo-mcp.io/t/serve-security-headers