Quick answer

Review missing security headers with the person responsible for application security. Headers such as Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, and frame protections have distinct purposes; adding them blindly can break a site or create false confidence.

What the issue means

A response header communicates browser security behaviour. The right policy depends on scripts, frames, embeds, referrers, content types, and deployment architecture.

Why it matters for SEO

These are primarily security and platform-health controls, not direct ranking switches. Stronger browser protections can support trustworthy operation, but an SEO crawler cannot certify security from a few headers.

How NOTABIS detects it

The missing-security-headers rule reports headers not observed on a sampled final response. It is origin-level evidence and does not test every route, policy interaction, exploit, or authenticated response.

How to check it yourself

Inspect headers on representative public and authenticated responses. Review browser console violations, deployment logs, CSP reports, embedding requirements, and security guidance before enforcing a policy.

How to fix it

Define each header deliberately at the correct application or proxy layer. Roll out CSP in report-only mode where appropriate, test legitimate assets and embeds, then enforce incrementally.

When it may be intentional

A header may be absent because a different control applies, the response is not a normal document, or a policy is still being designed. Record the rationale and verify the actual threat model.

Related issues

Review HSTS, cache policy, mixed content, and response headers separately.

Run a NOTABIS audit

NOTABIS can flag sampled header gaps for follow-up, but security verification should use a dedicated review process.