Security
The connection, the content and the headers that protect both — and the trust signals browsers show users.
0.13 of the composite scoreWhy does this matter — for rankings, traffic and trust?
HTTPS has been a ranking signal since 2014, and since 2018 Chrome labels every HTTP page "Not secure" — a word you never want next to your brand in the address bar. Modern TLS (1.2 minimum, 1.3 preferred) is table stakes; what separates an A from a C is protocols, key exchange and certificate hygiene.
Security headers are the cheapest brand insurance on the web. HSTS stops protocol downgrade attacks, CSP containing XSS, X-Frame-Options and frame-ancestors stop clickjacking (your site rendered inside a scam page), and Referrer-Policy stops leaking user URLs cross-site. None of them cost performance; all of them show up in every serious audit.
Version-disclosure headers (Server: nginx/1.24.0, X-Powered-By: Express) hand attackers a free fingerprint of your stack, and cookies without Secure/HttpOnly/SameSite can be stolen or forged in trivial attacks. For a marketing site these are one-evening fixes with permanent payoff.
Every signal in this division — exactly what the engine checks
How to fix it
What commonly causes failures here
- TLS 1.0/1.1 still enabled "for old clients" — or an expiring certificate.
- Framework-default response headers: no HSTS, no CSP, no X-Frame-Options.
- Server and X-Powered-By shouting exact versions to the internet.
- Session cookies without Secure / HttpOnly / SameSite.
- Missing MTA-STS and TLS-RPT — mail transport encryption left unenforced and unmonitored.
Best-practice setup
One nginx server block covers the TLS side and the header side together. Ship the headers with the safe values first; tighten the CSP gradually by watching your own console for violations.
server {
listen 443 ssl http2;
server_name example.com;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
# the header set (HSTS last — start with a short max-age to test)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
# stop disclosing versions
server_tokens off;
}Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax; Path=/
# Secure → never sent over http://
# HttpOnly → invisible to JavaScript (XSS cannot steal it)
# SameSite → not attached to cross-site requests (CSRF defense)# Express
app.disable('x-powered-by');
# nginx (if the app sets it anyway)
proxy_hide_header X-Powered-By;; enforce TLS for inbound mail
mta-sts.example.com. 3600 IN TXT "v=STSv1; id=20261001"
; https://mta-sts.example.com/.well-known/mta-sts.txt serves:
; version: STSv1
; mode: enforce
; mx: mail.example.com
; max_age: 31536000
; get the failure reports
_smtp._tls.example.com. 3600 IN TXT "v=TLSRPT1; rua=mailto:[email protected]"