Security headers and HSTS: a checklist for SEO teams
HTTPS, HSTS and four other security headers in plain English: what each one does, the value to start with, how to check them by hand, and the HSTS traps.
Security
HTTPS, mixed content, insecure forms and the security headers that keep a site trustworthy.
Guides
Every security check SEOSnip runs 5
The page isn't served securely
Browsers label HTTP pages as not secure, which puts visitors off, and anything they type is sent unencrypted.
How to fix
FixServe the page over HTTPS and redirect the insecure address.
For developersServe the page over HTTPS and 301-redirect http:// to https://.
The secure page loads insecure files
Browsers block or warn about insecure files on secure pages, which can break the page.
How to fix
FixLoad every image, script and style over HTTPS.
For developersChange http:// resource URLs to https:// (or relative), and fix their source in the CMS or theme.
Links within the site point to insecure addresses
They send visitors and search engines through a redirect, or to an insecure copy of the page.
How to fix
FixUpdate the links to their secure addresses.
For developersChange internal http:// links to https:// in templates and content.
A form sends visitors' details without encryption
What visitors type can be read in transit, and browsers warn people on these forms.
How to fix
FixMake sure every form is on, and submits to, a secure page.
For developersServe the page over HTTPS and set every form action to an https:// URL.
The site is missing recommended security settings
These server settings protect visitors from downgrade attacks, clickjacking and data leaks.
How to fix
FixAsk the developers or hosting provider to add the missing security headers.
For developersSend HSTS, Content-Security-Policy, X-Content-Type-Options: nosniff, frame protection and Referrer-Policy.
Find these issues on any page
SEOSnip checks the page in your browser, compares the server HTML with the rendered page, and turns each issue into a ticket with the evidence attached.