Crystal Ball checks covered

SECURITY_HEADERS_UNVERIFIED_SNAPSHOT, HSTS_MISSING, CSP_MISSING, X_CONTENT_TYPE_OPTIONS_MISSING, FRAME_PROTECTION_MISSING, REFERRER_POLICY_MISSING

Guide detail

Choose Your Technical Level

This setting applies to the meaning, causes, and fix sections. Your choice carries to other Fix Library guides on this device.

Practical explanations and page-specific steps. Recommended for most readers.

What this warning means

Crystal Ball reports security headers from a live HTTP response. A pasted HTML snapshot cannot prove whether they exist, and a missing header is not automatically an SEO problem.

  • HSTS, MIME sniffing protection, and frame restrictions reduce specific browser risks.
  • Content Security Policy can provide strong protection, but an incorrect policy can block analytics, forms, fonts, images, or scripts.
  • Modern browsers already apply a restrictive default referrer policy when no explicit header is sent.

Common causes and policy mistakes

Decide which hosts and third-party services the site genuinely needs before copying a header set from another website.

  • Inventory scripts, styles, images, fonts, frames, forms, and API connections.
  • Confirm whether any page must be embedded by another domain.
  • Do not enable HSTS includeSubDomains until every affected subdomain is HTTPS-ready.

How to fix it

Set headers at the web server, reverse proxy, CDN, or application boundary so they apply consistently to HTML responses.

  • Start Content Security Policy in Report-Only mode, review violations, then enforce a tested policy.
  • Use frame-ancestors in CSP or X-Frame-Options where legacy support is needed.
  • Set X-Content-Type-Options to nosniff.
  • Use a deliberate Referrer-Policy only when the browser default is not the intended policy.

How to verify

Fetch several live pages and inspect their final response headers after all redirects.

  • Test public pages, forms, embedded tools, analytics, and third-party widgets.
  • Confirm CSP reports are expected before enforcement.
  • Rerun a live URL scan; an HTML snapshot still cannot verify response headers.

FAQ

Do missing security headers lower Google rankings?

They are primarily security and implementation signals, not standalone ranking factors. HTTPS and a dependable user experience still matter, but the report should not overstate direct ranking impact.

Can I paste a strict CSP from another site?

No. A CSP must match the resources and integrations this site actually uses. Start with an inventory and Report-Only testing.

Need a Second Set of Eyes?

Run a scan, compare the finding with the right guide, and ask for support before changing risky SEO or server settings.

Contact Your SEO Wizard