Skip to main content
    SEO Academyby 盧卡山人

    HTTP Headers Analyzer Guide

    HTTP headers affect not only SEO (X-Robots-Tag, Canonical) but also website security (CSP, HSTS) and performance (Cache-Control). Learn to use this tool to quickly check and fix common issues.

    1) SEO-Critical Headers: X-Robots-Tag / Link (Canonical)

    • X-Robots-Tag: Controls indexing and crawling (noindex, nofollow, noarchive), works for non-HTML files like PDFs and images.
    • Link: rel="canonical": HTTP header version of canonical, takes precedence over HTML tag, ideal for dynamically generated pages.
    • Vary: Accept-Encoding: Tells CDN/cache servers to cache separately by encoding (gzip/br), preventing wrong version delivery to crawlers.
    http
    X-Robots-Tag: noindex, nofollow
Link: <https://example.com/page>; rel="canonical"
Vary: Accept-Encoding, User-Agent

    2) Performance Headers: Cache-Control / ETag / Last-Modified

    Proper caching strategies can significantly improve Core Web Vitals (LCP, FCP), reduce redundant requests, and lower server load.

    • Cache-Control: Sets cache duration (max-age) and strategy (public/private/no-cache).
    • ETag / Last-Modified: Supports conditional requests (304 Not Modified), saving bandwidth.
    • Common settings: Static assets 1 year (immutable), HTML pages 5 minutes, API responses no-cache.
    http
    Cache-Control: public, max-age=31536000, immutable
ETag: "abc123"
Last-Modified: Wed, 21 Oct 2024 07:28:00 GMT

    3) Security Headers: CSP / HSTS / X-Frame-Options

    These headers prevent XSS, hijacking, and man-in-the-middle attacks, increasing user trust and indirectly affecting SEO (HTTPS is a ranking signal).

    • Content-Security-Policy: Restricts resource origins (script/style/img), preventing XSS attacks.
    • Strict-Transport-Security: Enforces HTTPS, preventing downgrade attacks.
    • X-Frame-Options / X-Content-Type-Options: Prevents Clickjacking and MIME sniffing.
    http
    Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Frame-Options: DENY
X-Content-Type-Options: nosniff

    4) Workflow: Analyze → Fix → Verify

    1. Open HTTP Headers Analyzer, enter the URL to check.
    2. Review SEO headers (X-Robots-Tag, Link canonical), caching settings, and security headers.
    3. If important headers are missing, add them in server config (Nginx/Apache) or CDN (Cloudflare).
    4. Re-test to confirm headers are returned correctly, and verify performance and security scores with Lighthouse.

    Related Reading

    Technical SEOSEO BasicsX-Robots-TagCanonical URLCore Web VitalsHTTPS

    FAQ

    HTTP headers implementation and best practices.