Security headers explained: HSTS & X-Content-Type-Options

What are security headers?

Security headers are HTTP response headers that instruct browsers to enable (or disable) specific security features. They're set by your web server or CDN and sent with every response. Unlike meta tags that live in HTML, security headers operate at the transport layer — browsers read them before they even start parsing your page.

There are dozens of security headers, but our engine focuses on the two that intersect most directly with SEO and site integrity:

• Strict-Transport-Security (HSTS): Forces HTTPS — prevents HTTP downgrade attacks and eliminates redirect chains.
• X-Content-Type-Options: Prevents MIME-sniffing — stops browsers from reinterpreting file types.

Why security headers matter for SEO

HTTPS has been a confirmed Google ranking signal since 2014. HSTS ensures browsers always connect over HTTPS — eliminating the HTTP-to-HTTPS redirect chain that costs 100–300ms per request. For Googlebot, this means:

• Faster crawling: No redirect chain means Googlebot reaches your content faster, using less of your crawl budget.
• No accidental HTTP indexing: Without HSTS, Google may discover and attempt to index HTTP versions of your pages from old links or sitemaps.
• Trust signals: Sites with proper security headers are less likely to be compromised and serve malicious content — a factor Google considers when evaluating site quality.

X-Content-Type-Options doesn't directly affect rankings, but a compromised site (from a MIME-sniffing attack) can lead to Google flagging your site with a "This site may be hacked" warning — devastating for organic traffic.

How our engine checks security headers

We run two security header checks on every page:

Check 1: HSTS (Strict-Transport-Security)

ID: quick-hsts
Severity: Info
Scope: Per page
Logic: For HTTPS pages, we check whether the response includes a Strict-Transport-Security header. If the page is not served over HTTPS, the check is skipped (not applicable). If the page is HTTPS but the header is missing, the check fails.

What a good HSTS header looks like:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

• max-age=31536000: Browser remembers to use HTTPS for 1 year (the minimum recommended value).
• includeSubDomains: Applies HSTS to all subdomains too.
• preload: Opt-in to be included in browsers' built-in HSTS preload list (submit at hstspreload.org after deploying the header).

Check 2: X-Content-Type-Options

ID: quick-x-content-type-options
Severity: Info
Scope: Per page
Logic: We check whether the response includes an X-Content-Type-Options header with the value nosniff. Any other value (or no header) fails the check.

Why nosniff: Without this header, browsers may try to "sniff" the MIME type of a response — for example, treating a text/plain file as JavaScript if it looks like code. An attacker who can upload a file to your server could exploit this to run arbitrary scripts in visitors' browsers.

How to read your security headers result

When you run a URL through our free checker, each security header check shows:

• Pass (green): The header is present with the correct value. No action needed.
• Info (blue) — HSTS missing: Your HTTPS page doesn't set HSTS. Add the header to your server config.
• Info (blue) — X-Content-Type-Options missing: The nosniff header isn't set. Add it to your server config.
• Skipped — not HTTPS: HSTS only applies to HTTPS pages. If your site isn't on HTTPS yet, that's a more fundamental issue to fix first.

Both checks are severity "Info" rather than "Warning" because they don't directly prevent indexing or break functionality — but they're strongly recommended for any production site.

How to add security headers

Where you add these headers depends on your hosting setup:

Apache (.htaccess)

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set X-Content-Type-Options "nosniff"

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;

Cloudflare

Cloudflare enables HSTS natively: go to SSL/TLS → Edge Certificates → HTTP Strict Transport Security and toggle it on. For X-Content-Type-Options, use a Transform Rule (Modify Response Header) or a Cloudflare Worker.

Security headers and AI visibility

AI crawlers (GPTBot, ClaudeBot, PerplexityBot) follow the same HTTPS conventions as traditional search engines. A site with proper HSTS is less likely to serve mixed content or get flagged as insecure — making AI systems more confident about citing it as a source.

For a deeper look at AI crawler behavior, see our Complete list of AI crawlers guide.

FAQ

What is the HSTS header?

HSTS (HTTP Strict Transport Security) is a response header that tells browsers to only connect to your site over HTTPS. Once a browser sees the header, it automatically upgrades all future requests to HTTPS for the duration specified by max-age, preventing man-in-the-middle attacks.

Do security headers affect SEO?

HTTPS is a confirmed Google ranking signal, and HSTS ensures browsers always use HTTPS — eliminating HTTP-to-HTTPS redirect chains that slow down crawling. X-Content-Type-Options prevents attacks that could lead to your site being flagged as compromised.

What is X-Content-Type-Options: nosniff?

It's a security header that prevents browsers from MIME-type sniffing — guessing a file's type based on its content rather than its declared Content-Type header. Without it, an attacker could trick a browser into executing a malicious file.

How do I add security headers to my site?

Where you add headers depends on your hosting: in Apache, use .htaccess; in Nginx, use the server block; in Cloudflare, use Transform Rules or the SSL/TLS settings. Most CDNs and platforms have a dedicated security headers section.