What six security headers do—and their limits: connections, content loading, embedding, and privacy

Security headers have different protective roles and cannot replace one another: HSTS governs HTTPS connections, X-Content-Type-Options and CSP help protect against malicious content, X-Frame-Options controls embedding, Referrer-Policy controls referrer information, and Permissions-Policy restricts browser features. Choose them based on your website’s needs and browser support. Having headers configured does not mean a website is fully protected, nor does it directly imply improved search rankings.

Connections and content loading: three distinct lines of defense

• Strict-Transport-Security (HSTS): Requires browsers to connect to the website over secure HTTPS connections. It addresses connection security and should not be confused with CSP, which restricts content sources.
• X-Content-Type-Options: The source material states that its nosniff directive helps protect against cross-site scripting (XSS), but explicitly cautions that it is not a complete solution.
• Content-Security-Policy (CSP): Restricts the sources from which browsers can load content to help protect against XSS and data injection attacks. The Search Engine Journal author strongly recommends using it, but this is the author’s recommendation, not a search engine ranking rule.

Checking whether a connection is secure and checking what content a browser can load are therefore separate tasks. Verifying just one does not justify declaring the entire website secure.

Restricting embedding: X-Frame-Options and CSP

X-Frame-Options restricts other websites from displaying a website’s content through an iframe. If the concern is content being embedded on other pages, this header directly addresses it. CSP’s frame-ancestors is another way to restrict embedding mentioned in the source material.

The article quotes Google’s John Mueller as saying that preventing other websites from embedding content “might” affect SEO, while the other security headers primarily concern security. This does not mean configuring the header will necessarily improve rankings, nor should iframe restrictions be described as preventing all forms of content appropriation.

Referrer information and feature permissions: first identify what you want to control

• Referrer-Policy: Controls how much referrer information is shared with other websites when users click external links. In addition to an HTTP header, it can be configured through an HTML meta tag or on individual links. It is relevant when considering information disclosed through outbound links.
• Permissions-Policy: Restricts the browser features and hardware APIs a website can use. It governs feature access, not the referrer information sent when following outbound links.

Browser support is an important limitation of the latter: the June 2026 source article states that many popular browsers do not support Permissions-Policy, but does not identify the browsers or versions. This does not justify concluding that the same restrictions will apply to all visitors.

Security audits and SEO audits do not promise the same outcomes

The article’s author argues that some other security headers also deserve inclusion in SEO audits because website security helps maintain search visibility. This is a broader position than Mueller’s comments focusing on embedding restrictions. The two should be understood separately: being worth checking for security does not mean every header is a ranking factor. An assessment should first clarify the situation requiring protection, then explain whether its relationship to search performance is direct, an indirect consideration, or unsupported by the available material.