People tend to gloss over security headers when creating a website. It’s unnecessary work, they say, and it doesn’t even affect SEO at all, so why should we bother with it?
Well, according to Los Angeles SEO experts, your site’s security does matter for SEO albeit indirectly. If your website is largely unprotected and hackers somehow worm their way in, it compromises your viewer’s privacies and leaves them vulnerable to identity theft and phishing. This, in turn, makes Google rank your site lower. Security headers also matter if your competitors all have one and you don’t—they provide a safer and better user experience than you do, which makes Google rank them higher.
So, whether you like it or not, security headers do matter in SEO, and you’d be wise to add them to your website as soon as possible. But what exactly are security headers?
What is a Security Header?
Security headers are directives from a website to a browser. They tell your browser what it can and what it cannot do on the site.
For example, the website might tell your browser to download a font from Google Fonts to see the website exactly how the designer designed it. The security header will then tell you that it’s okay to download files from Google but trust no other downloadable files from other domains. It’s like having a personal bodyguard for all your viewers.
Security headers are important because they prevent malicious files from infiltrating your customers’ devices. They also prevent you from losing traffic and ensure your site is functioning normally. After all that hard work setting up a website and widening your reach, surely you wouldn’t want to see it crashing down in an instant?
Luckily, they’re fairly easy to implement, especially if you’ve got Drive Traffic Media by your side! Here’s our list of common security headers we offer as part of our SEO services in Los Angeles.
Content Security Policy (CSP)
Content Security Policy is protection against Cross-Site Scripting (XSS). It helps plug holes that attackers use to insert malicious scripts into a website. CSP does this by instructing browsers to only trust a set group of domains and block any other domain that tries to run something malicious.
CSP is one of the first security headers you need to establish even before launching your website.
Strict-Transport-Security Header (HSTS)
HTTPS is a securer version of HTTP that ensures exchanged information is between the website and the viewer only. Since it’s a fairly recent development, some websites have migrated from HTTP to HTTPS with a simple 301 redirect (i.e., http://www.website.com 🡪 https://www.website.com) instead of having HTTPS from the beginning. This leaves them vulnerable to man-in-the-middle attacks.
These happen when the old HTTP version is still used. Users could have the HTTP version bookmarked, or maybe Google has the HTTP version indexed. Hackers can then use the downgraded website to access sensitive information.
An HSTS security header prevents this from happening by forcing browsers to load only the HTTPS version.
X-Content-Type-Options
Some old browsers (particularly Internet Explorer) use a “sniffing” technique to determine what type of content is on a website. For example, if someone uploads an image onto their website but doesn’t specify it’s an image with content data or metadata, the browser “sniffs” the website and tries to guess what the content is so it can render it.
Hackers then try to disguise their malware as image or music files, have the browser “sniff” it, and have the malware downloaded into their computer.
X-Content-Type-Options is a security header that disables a browser’s ability to sniff with no exceptions.
X-Frame Options
Click-jacking is characterized by hiding a page a user did not intend to visit in plain sight. It is usually invisible and transposed on a website the user did intend to visit.
For example, you were tempted to visit a website offering free movies. A hacker could access your online bank account from their computers and have it laid out on your screen. Instead of downloading movies, you could actually be transferring money out of your account.
X-Frame Options help prevent clickjacking attacks by preventing a page from being uploaded on a separate site.
Referrer-Policy
When you visit Website B from Website A, Website B gets information about you from Website A. This can include sensitive information you don’t consent to share with Website B.
Referrer-Policy prevents this from happening by limiting the information Website A shares with Website B or not referring to anything at all.
Conclusion
It’s always better to be safe than sorry. Having security headers on your website is a fairly quick and easy way of protecting your customers from attacks and preventing your site from falling off the ranks. You don’t have to have every security header on this list, but the more you have the greater your site’s protection is.
If you want to learn more about security headers and adding them to your site, contact Drive Traffic Media at (310)341-3939 or at info@drivetrafficmedia.com. We are a digital marketing agency with a very reliable web hosting server in Los Angeles.
