Security headers are quiet instructions your website sends to every visitor's browser telling it how to behave safely. Customers never see them, but Chrome does — and so do the security scanners that increasingly influence trust and rankings. The good news: adding the important ones is usually a one-time job.

What a "header" actually is

Every time someone visits your site, your server sends back the page plus a set of hidden notes called headers. Security headers are the notes that say things like "always use an encrypted connection" or "don't run scripts from anywhere except these trusted sources." Without them, the browser falls back to permissive defaults — which is exactly what attackers rely on.

You only need a handful

There are dozens of possible headers. For a local business site, four cover the overwhelming majority of real-world risk. Start there; you can always add more later.

HTTPS and HSTS — the padlock, enforced

HTTPS encrypts the connection between your visitor and your site; it's what puts the padlock in the address bar. If you don't have it, Chrome labels your site "Not secure" — a visible red flag to every visitor.

HSTS (Strict-Transport-Security) goes one step further: it tells the browser to only ever connect to you over HTTPS, so nobody can be tricked onto an unencrypted version of your site. It's the header that turns "we support encryption" into "we require it."

Content-Security-Policy — the bouncer

CSP is the most powerful header and the one most sites are missing. It lists exactly which sources are allowed to load scripts, styles and images on your page. If an attacker manages to inject malicious code, CSP blocks it from running because it isn't on the guest list.

A Content-Security-Policy is the difference between an injected script running on your customers' browsers and being silently blocked at the door.

The other two quick wins

  • X-Content-Type-Options: nosniff — stops the browser from guessing file types in unsafe ways.
  • Referrer-Policy — controls how much information your site leaks when a visitor clicks a link away.

How to add them on your platform

WordPress

A reputable security plugin adds most headers with a few clicks. HTTPS comes from your host's free certificate (Let's Encrypt).

Squarespace, Wix, Shopify

HTTPS and basic headers are handled for you automatically. You generally can't add a custom CSP, which is a reasonable trade-off on a hosted platform.

Custom or developer-built sites

Headers are set on the web server or CDN. Send your developer your scanner report and ask them to "add the missing security headers, including HSTS and a Content-Security-Policy."

Grade yourself in five minutes

  • HTTPS active — padlock shows, no "Not secure" warning
  • HSTS present — connection is HTTPS-only
  • A Content-Security-Policy is defined
  • X-Content-Type-Options set to nosniff
Test before and after

Run your URL through a free "security headers" scanner, note your grade, make the changes, then re-scan. You want to move from an F or D up to an A or B. It's one of the most satisfying quick wins in web security.

Common questions

Do security headers affect my Google ranking?

HTTPS is a confirmed lightweight ranking signal, and a "Not secure" label hurts trust and click-through. The other headers mainly protect your site and visitors, which indirectly protects your rankings by keeping you off blacklists.

Can adding a CSP break my site?

A too-strict CSP can block legitimate scripts, so it should be rolled out in "report-only" mode first, then enforced once you've confirmed nothing legitimate is blocked.

I'm on Squarespace — do I need to do anything?

Mostly no. HTTPS and core headers are managed for you. Your effort is better spent on your Google Business Profile and reviews.

Want this handled for you? Run a free audit and ranker.bot will find the issues, prioritise them, and fix the ones you approve — in plain English, no agency retainer.