How to audit security headers site-wide

Search engines factor browsing safety into ranking via Chrome's Safe Browsing data. Missing HSTS, weak CSP, and clickjacking-vulnerable headers all degrade trust scores. Beyond SEO, security headers are a baseline compliance requirement for SOC 2, ISO 27001, and most enterprise procurement reviews. The audit is short; the upside is broad.

Step 1. Site-wide grade

Site → Security Headers grades every page on the following headers:

• Strict-Transport-Security (HSTS)
• Content-Security-Policy (CSP)
• X-Content-Type-Options
• X-Frame-Options or frame-ancestors in CSP
• Referrer-Policy
• Permissions-Policy

Each page receives an A through F grade. Most sites land at C or D on the first audit; perfect A is rare without explicit effort.

Step 2. Roll out CSP safely

CSP is the highest-impact but most fragile header. Roll out in stages:

1. Deploy Content-Security-Policy-Report-Only with a permissive policy first.
2. Collect violation reports for one to two weeks.
3. Tighten the policy based on real usage data.
4. Switch from report-only to enforce.

Step 3. Watch for header drift

A common failure mode: nginx config gets updated, a header is removed from one route, and no one notices for weeks. 2-UA polls headers continuously and alerts on drift, so silent regressions surface within hours.

Step 4. Add HSTS preload

Once HSTS is stable for six or more months with max-age=31536000; includeSubDomains, submit your domain to the HSTS preload list. This locks your site to HTTPS at the browser level, removing the trust-on-first-use window.

Three header configuration mistakes that recur

• CSP blocking analytics or payment iframes — first violations are usually third-party scripts you forgot about.
• HSTS without includeSubDomains on the apex — leaves subdomains unprotected against downgrade attacks.
• X-Frame-Options and frame-ancestors conflicting — newer browsers prefer frame-ancestors; X-Frame-Options is the fallback.

Where to start if you have zero headers today

HSTS first — lowest risk, highest impact. Then X-Content-Type-Options: nosniff. Then CSP in report-only mode. Then tighten one header per sprint. Direct SEO impact is small per header but cumulative across the set; indirect compliance and security posture impact is substantial from week one.

Run the free SEO page audit for an instant single-page security headers grade, or open a project for continuous grading and drift alerts.