How to fix missing security headers

Security headers are response headers that tell a browser how carefully to treat your site. They cost nothing, they are set once at the server or CDN, and most sites have none of them — including, at the time of writing, this one.

What an audit of this site returns

high     security.no_http_redirect    http://docketseo.app does not redirect to https://
low      security.no_hsts             No HSTS header
notice   security.missing_headers     Missing 2 baseline security headers

All three are true. We checked the first by hand before believing it, which is the rule we apply to findings about anybody else's site:

$ curl -sI http://docketseo.app/
HTTP/1.1 200 OK
Server: GitHub.com

Two hundred, over plain http, with no redirect. The www host redirects correctly; the apex does not — which is the same half-configured shape Docket found on a French bakery chain the same week, and the reason its redirect finding now names the exact host it probed instead of saying "http://".

The three headers worth having

Strict-Transport-Security. Tells the browser to use https for this site from now on, so a visitor who types the bare domain never makes the plain-http request at all. Start with a short max-age, confirm nothing breaks, then raise it:

Strict-Transport-Security: max-age=31536000; includeSubDomains

X-Content-Type-Options: nosniff. Stops the browser guessing that something you served as text is really a script. One line, no trade-offs.

Referrer-Policy. Controls how much of the current URL is passed to sites you link to. strict-origin-when-cross-origin sends the full path within your own site and only the origin to anyone else — which matters if your URLs contain anything you would not print on a postcard.

X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin

Why we have not fixed ours

Because we cannot. This site is served by GitHub Pages, which does not let you set response headers. There is no configuration file for it, no setting, and no supported workaround short of putting a CDN in front of the whole site.

That is a real trade-off and it is the honest reason, not an excuse. Static hosting that costs nothing and cannot go down in an interesting way is worth a great deal, and the headers it cannot set are worth less than that. If this site accepted logins or took payments the calculation would be different and we would be on something else.

The http redirect is a separate matter and it is a hosting setting rather than a header, so it is fixable. It is on the list.

Where to actually set them

• Cloudflare, Fastly, or any CDN — a rule at the edge, applied to every response, no deploy needed.
• Nginx — add_header in the server block.
• Apache — Header set in the vhost or .htaccess.
• Netlify, Vercel — a headers file in the repository.
• GitHub Pages — not possible, as above.

How much does this matter for SEO

Directly, almost nothing. Google has said https is a lightweight ranking signal and has never suggested these headers are. Anyone selling you security headers as a ranking factor is guessing.

Indirectly it matters more than the ranking question. A page reachable over plain http can be modified between the server and the reader — and on this site, one of those pages tells people how to verify a signed and notarised binary. Instructions for checking a signature are exactly the instructions worth tampering with. That is the argument for the redirect, and it has nothing to do with rankings.

Download Docket

Common questions

Do security headers help SEO?

Directly, almost nothing. Google treats https as a lightweight ranking signal and has never suggested these headers are one. The real argument is that a page reachable over plain http can be modified in transit, which matters most on pages that tell people how to verify something.

What is the minimum set of security headers?

Strict-Transport-Security so browsers stop making plain-http requests, X-Content-Type-Options: nosniff so the browser does not guess content types, and Referrer-Policy: strict-origin-when-cross-origin so your full URLs are not handed to every site you link to.

Can I set security headers on GitHub Pages?

No. GitHub Pages does not support custom response headers and there is no configuration file for them. The supported route is putting a CDN in front of the site. This site runs on GitHub Pages and therefore fails two of these checks itself.

Should HSTS max-age start high?

No. Start with a short max-age, confirm nothing on the site breaks over https, and raise it afterwards. A long max-age set before you are certain commits every returning browser to https for that period.