Security Headers

Security headers protect users and signal to search engines that your site is trustworthy. Google’s Safe Browsing and HTTPS enforcement are confirmed ranking signals. Missing headers are also common attack vectors that can result in site compromise — which causes deindexation.

HTTPS enforcement

The most basic security check. VisibilityIQ verifies:

• Your domain redirects http:// to https:// (301 or 308, not 302)
• The redirect is in place at both the apex domain and www
• There is no mixed content on the page (HTTP resources loaded on an HTTPS page)

Mixed content is when a page served over HTTPS loads images, scripts, or other resources over HTTP. Browsers block active mixed content (scripts, iframes) and warn on passive mixed content (images, audio). VisibilityIQ flags mixed content at High severity when it involves scripts and Medium for passive resources.

HSTS — HTTP Strict Transport Security

HSTS tells browsers to always use HTTPS for your domain, preventing protocol downgrade attacks. The header looks like:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

VisibilityIQ checks:

• Presence — is the HSTS header set?
• max-age — should be at least 1 year (31536000 seconds) for preload eligibility
• includeSubDomains — recommended if all your subdomains serve HTTPS
• preload — allows submission to browser HSTS preload lists for extra protection

Missing HSTS is flagged at Medium severity. When it’s present but misconfigured (max-age too short, missing includeSubDomains), it’s flagged at Low.

The generated fix shows the exact header value to add to your server or CDN configuration.

Content-Security-Policy (CSP)

CSP prevents cross-site scripting (XSS) attacks by specifying which sources are allowed to load scripts, styles, images, and other resources. A missing or overly permissive CSP is flagged.

VisibilityIQ doesn’t attempt to validate your full CSP policy (that requires knowing all your legitimate resource origins), but flags:

• Missing CSP — no policy at all (Medium)
• Unsafe directives — unsafe-inline or unsafe-eval in script-src (Low — these are sometimes necessary but worth reviewing)

X-Content-Type-Options

X-Content-Type-Options: nosniff

This header prevents browsers from “sniffing” the MIME type of a resource, which can lead to XSS via MIME confusion. It’s a one-liner to add and is flagged at Medium if missing.

X-Frame-Options

X-Frame-Options: DENY

or

X-Frame-Options: SAMEORIGIN

Prevents your pages from being embedded in iframes on other domains (clickjacking protection). Modern equivalent is Content-Security-Policy: frame-ancestors 'none'. Missing on pages that don’t need to be iframed is flagged at Low.

Permissions-Policy

Formerly called Feature-Policy, this header controls access to browser APIs (camera, microphone, geolocation, etc.). Missing on pages that don’t use these APIs is flagged at Info — it’s not a security risk if you’re not using those APIs, but setting it explicitly is good practice.

Certificate validity

VisibilityIQ checks your TLS certificate for:

• Expiration — certificates expiring within 30 days are flagged at High, within 14 days at Critical
• Hostname mismatch — certificate doesn’t cover the domain being accessed
• Weak signature algorithm — SHA-1 certificates (should be SHA-256 or better)

Generated fixes

For missing headers, VisibilityIQ generates the exact header values to add. For Cloudflare users, it also notes which headers can be set via Cloudflare Transform Rules rather than origin server configuration.

Why security headers affect SEO

Beyond direct ranking signals (Safe Browsing status, HTTPS), security issues matter for SEO because:

• A compromised site gets deindexed rapidly and may take months to recover
• Malware injection can add spammy links that damage your site’s authority
• CSP errors in the browser console can interfere with rendering, creating parity issues
• Trust signals affect click-through rates in SERP results