ShipcheckSecurity headers explained: HSTS, CSP, and the six that matter at launch
What HSTS, Content-Security-Policy, X-Frame-Options, and related headers do, which ones to ship first, and how to check them on a live URL.
Short answer
Security headers tell browsers how to treat your site: force HTTPS (HSTS), limit scripts and frames (CSP and X-Frame-Options), control referrer and permissions, and stop MIME sniffing. Prioritize HTTPS plus HSTS, a workable CSP, and clickjacking protection before launch, then verify with a headers checker.
Run the free security headers checker, then pair it with the website checker for HTTPS and redirect basics.
Why headers matter at launch
HTTP response headers tell the browser how to treat your pages: whether to force HTTPS, which scripts may run, and whether other sites may embed you in an iframe. Agencies and clients increasingly expect these on handoff. They are also easy to miss when an AI builder or static host ships a bare default config.
The six headers that matter most
- Strict-Transport-Security (HSTS) — after HTTPS works, tell browsers to stay on HTTPS for a long max-age.
- Content-Security-Policy (CSP) — limit where scripts, styles, and frames may load from; the strongest XSS defense when done carefully.
- X-Frame-Options or frame-ancestors in CSP — reduce clickjacking by controlling embedding.
- X-Content-Type-Options: nosniff — stop browsers from guessing MIME types.
- Referrer-Policy — control how much URL data leaves with outbound clicks.
- Permissions-Policy — turn off camera, mic, and other APIs you do not use.
What to ship first
- TLS certificate and a single HTTP→HTTPS redirect (see the redirect guide).
- HSTS once you are sure every hostname works on HTTPS.
- X-Content-Type-Options and a sensible Referrer-Policy (low risk).
- Clickjacking protection for marketing and app shells.
- CSP once you inventory third-party scripts (analytics, chat, payments).
How to verify
After deploy, open the security headers checker. Re-run after CDN or middleware changes. For the full pre-launch pass, use the website launch checklist and the AI-built site checklist.
Questions
Do security headers help SEO rankings?
Not as a direct ranking factor. They protect users and trust. Missing HTTPS or broken redirects can still hurt crawl and click-through.
Which header should I add first?
Serve the site on HTTPS, redirect HTTP to HTTPS, then add Strict-Transport-Security (HSTS). Add a Content-Security-Policy after you know which scripts and images you need.
Will a strict CSP break my site?
Yes, if you copy a policy that blocks your own scripts, analytics, or fonts. Start in report-only mode or with a loose policy, then tighten.
How do I check my live headers?
Use the free Shipcheck security headers checker on the production URL after deploy, then re-check after CDN or host changes.
Tools for this guide
Security headers checker
Grade HSTS, CSP, and four more headers, then copy the config for your host.
Open tool →Free website checker
Paste a public URL for one report from server HTML plus Google PageSpeed. Use the extension for localhost, JS-heavy apps, and the full audit.
Open tool →HTTP status & redirect checker
Follow the redirect chain hop by hop: status codes, Location headers, HTTPS upgrades, and long chains.
Open tool →More guides
Schema markup for small sites: JSON-LD that helps Google and AI answers
Which schema types small sites actually need, how to add JSON-LD safely, and how structured data helps rich results and AI citation—not magic rankings.
Read · 9 min →HTTP redirects and status codes: 301, 302, chains, and crawl waste
When to use 301 vs 302, how redirect chains hurt SEO and speed, and how to check a live URL hop by hop.
Read · 8 min →Broken links and dead anchors: find them before launch
Why 404s and missing #section targets hurt users and crawl paths, how to check a page, and what to fix first.
Read · 7 min →