What Do Security Headers Do?
Security headers are instructions your server sends with every page that tell browsers how to handle it safely. This check looks at HTTPS and six response headers:
- Content-Security-Policy: limits which scripts, styles and other resources a page may load, which reduces the impact of injected content.
- Strict-Transport-Security: tells browsers to use HTTPS only for your domain.
- X-Frame-Options: stops other sites from embedding your pages in frames (clickjacking).
- X-Content-Type-Options: stops browsers from guessing file types.
- Referrer-Policy: controls how much of the page address is shared when visitors follow a link.
- Permissions-Policy: restricts access to browser features such as the camera, microphone and location.
Where do I add these headers?
They are set by your web server, CDN or application. Each missing header is scored, and the report gives fix code for Nginx, Apache and Express.
Do security headers change my AI Visibility Score?
On the main audit, security is shown on the report but does not change the visibility score. Missing headers are still worth fixing for visitor safety.