Technical SEO
X-Frame-Options / CSP
X-Frame-Options and Content Security Policy (CSP) are HTTP response headers that protect websites from clickjacking and unauthorized content injection while supporting SEO trust signals.
Explained
What are X-Frame-Options and CSP?
X-Frame-Options and Content Security Policy (CSP) are HTTP response headers that protect websites from clickjacking and unauthorized content injection. X-Frame-Options controls whether a page can be embedded in an iframe, while CSP provides broader control over which scripts, stylesheets, images, and other resources a browser may load.
Primary X-Frame-Options directives
- DENY – prevents all framing.
- SAMEORIGIN – allows framing only from the same domain.
- ALLOW-FROM – permits framing from specified URLs, though it is deprecated in favor of CSP frame-ancestors.
Key CSP directives
- default-src – baseline policy for all resource types.
- script-src / style-src / img-src / connect-src – granular control for specific resource types.
- frame-ancestors – modern replacement for X-Frame-Options.
- report-uri / report-to – endpoints for collecting policy violation reports.
- upgrade-insecure-requests – automatically upgrades HTTP requests to HTTPS.
SEO relationship
These headers support Google’s E-A-T (Expertise, Authoritativeness, Trustworthiness) signals by demonstrating site security. Secure sites are favored in rankings, while compromised sites can face penalties. CSP can also improve page speed by blocking unnecessary resource requests, contributing to better Core Web Vitals scores.