Checks / Links, canonical and speed

Security headers missing

Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy protect visitors from injected scripts, clickjacking and leaking URLs.

security_headers_missing · Links, canonical and speed · Notice

What triggers it

Your home page's response lacks at least one of Content-Security-Policy, X-Content-Type-Options, X-Frame-Options (not counted when the Content-Security-Policy has frame-ancestors) and Referrer-Policy.

What to change

Add the headers in the fix box to your server or CDN configuration.

Example

Response headers to add on your server or CDN:

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

How to confirm the fix

Run curl -I https://example.com/ and check each header is in the response
Run a new crawl

How common it is

We have not measured how common this is on a sample of sites. Counts appear here when a study covers it.

About this check

Check ID	`security_headers_missing`
Report section	Links, canonical and speed
Severity	Notice
How it is decided	Measured: read directly from the page or the server's response.
Added	Before 19 Oct 2026 (versions 1 and 2), or a site-wide check with no version date yet
Status	Measured in every report
Report gives the code	Yes, one block for the site

Settings by platform

Where the setting lives on a few platforms, from each platform's own help page, read on 26 October 2026. On any other server, apply the fix box above.

Cloudflare

In Cloudflare: Rules Overview → Create rule → Response Header Transform Rule → Set static. (Cloudflare help page)

Netlify

Netlify: put this in _headers. (Netlify help page)

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Content-Security-Policy: frame-ancestors 'self'
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()

Vercel

Vercel: put this in vercel.json. (Vercel help page)

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Strict-Transport-Security",
          "value": "max-age=31536000; includeSubDomains"
        },
        {
          "key": "Content-Security-Policy",
          "value": "frame-ancestors 'self'"
        },
        {
          "key": "X-Content-Type-Options",
          "value": "nosniff"
        },
        {
          "key": "X-Frame-Options",
          "value": "SAMEORIGIN"
        },
        {
          "key": "Referrer-Policy",
          "value": "strict-origin-when-cross-origin"
        },
        {
          "key": "Permissions-Policy",
          "value": "camera=(), microphone=(), geolocation=()"
        }
      ]
    }
  ]
}

Related checks

See whether it applies to your site

Paste your address and we crawl up to 10 pages and show every issue we find, with its fix. No account, no card.

Check my site free

Every plan crawls up to its page limit and lists these checks with the fix: plans.

How an audit works: method