Security headers monitoring: detect regressions before they hurt your site

Security headers are HTTP response headers that instruct the browser how to behave when handling your site's content. Missing or misconfigured headers are a quiet but persistent risk — they expose your site to clickjacking, MIME sniffing, cross-site scripting, and other client-side attacks.

Why SEO teams should care

Google measures trust signals and site quality as part of ranking. Security headers are a direct indicator of technical hygiene. More importantly, a compromised or injected page can quietly harm your organic rankings, user trust, and conversion — often before you detect it manually.

The six headers that matter most

• Strict-Transport-Security (HSTS) — Forces HTTPS connections and prevents protocol downgrade attacks. Adding includeSubDomains extends protection across all subdomains.
• X-Content-Type-Options — Set to nosniff to prevent browsers from guessing MIME types, blocking drive-by-download attacks.
• X-Frame-Options — Controls whether your pages can be embedded in iframes. Use SAMEORIGIN or DENY to block clickjacking.
• Content-Security-Policy (CSP) — The most powerful header. Restricts which scripts, styles, and resources the browser can load. Effective CSP is your primary XSS defense.
• Referrer-Policy — Controls how much referrer information is passed to third parties. strict-origin-when-cross-origin is the recommended modern default.
• Permissions-Policy — Restricts access to browser APIs like camera, microphone, and geolocation from your pages and embedded iframes.

How scoring works

Each header contributes to a 0–100 security score. The grade (A through F) reflects the overall coverage:

• HSTS: 20 points (+5 bonus for includeSubDomains)
• X-Content-Type-Options: 15 points
• X-Frame-Options: 15 points
• Content-Security-Policy: 25 points
• Referrer-Policy: 15 points
• Permissions-Policy: 10 points

A score of 90+ earns an A. Below 25 is an F. The goal is not a perfect score — it's knowing your current baseline and tracking regressions before they affect users.

How 2-UA collects security headers

Security headers are collected automatically during every desktop content check of your tracked URLs. No extra configuration is needed. Open any tracked URL and choose Security headers from the Quick menu to see the current grade, score, and per-header breakdown.

The site-wide summary view shows all your tracked URLs ranked by security score, making it easy to prioritize which pages need attention first.

Practical monitoring workflow

1. Run a content check for your critical tracked URLs.
2. Open the Security headers view and check the grade column.
3. For any header marked Missing, apply the recommendation shown in the detail view.
4. After deploying the fix, the next content check will automatically update the score.
5. Use the site-wide summary to confirm all important pages stay at grade B or higher.

Security regressions — like a CSP header being removed after a deployment — are easy to miss manually. Recurring automated checks catch these the moment they happen.