Crystal Ball checks covered

SECURITY_HEADERS_UNVERIFIED_SNAPSHOT, HSTS_MISSING, CSP_MISSING, X_CONTENT_TYPE_OPTIONS_MISSING, FRAME_PROTECTION_MISSING, REFERRER_POLICY_MISSING

What this warning means

Crystal Ball reports security headers from a live HTTP response. A pasted HTML snapshot cannot prove whether they exist, and a missing header is not automatically an SEO problem.

  • HSTS, MIME sniffing protection, and frame restrictions reduce specific browser risks.
  • Content Security Policy can provide strong protection, but an incorrect policy can block analytics, forms, fonts, images, or scripts.
  • Modern browsers already apply a restrictive default referrer policy when no explicit header is sent.

Choose the policy before the syntax

Decide which hosts and third-party services the site genuinely needs before copying a header set from another website.

  • Inventory scripts, styles, images, fonts, frames, forms, and API connections.
  • Confirm whether any page must be embedded by another domain.
  • Do not enable HSTS includeSubDomains until every affected subdomain is HTTPS-ready.

How to implement it

Set headers at the web server, reverse proxy, CDN, or application boundary so they apply consistently to HTML responses.

  • Start Content Security Policy in Report-Only mode, review violations, then enforce a tested policy.
  • Use frame-ancestors in CSP or X-Frame-Options where legacy support is needed.
  • Set X-Content-Type-Options to nosniff.
  • Use a deliberate Referrer-Policy only when the browser default is not the intended policy.

How to verify

Fetch several live pages and inspect their final response headers after all redirects.

  • Test public pages, forms, embedded tools, analytics, and third-party widgets.
  • Confirm CSP reports are expected before enforcement.
  • Rerun a live URL scan; an HTML snapshot still cannot verify response headers.

FAQ

Do missing security headers lower Google rankings?

They are primarily security and implementation signals, not standalone ranking factors. HTTPS and a dependable user experience still matter, but the report should not overstate direct ranking impact.

Can I paste a strict CSP from another site?

No. A CSP must match the resources and integrations this site actually uses. Start with an inventory and Report-Only testing.

Need a Second Set of Eyes?

Run a scan, compare the finding with the right guide, and ask for support before changing risky SEO or server settings.

Contact Your SEO Wizard