Why does hSTS with a long max-age, includeSubDomains and preload matter?

Without it the first request of every session is plain http and redirectable. With preload the browser never makes that request at all. Verify it: Run `curl -sI https://example.com | grep -i strict-transport`.

Why does x-Content-Type-Options nosniff matter?

Without it a browser may execute a file the server labelled as text, which turns a file upload into a script injection. Verify it: Run `curl -sI https://example.com | grep -i x-content-type-options`.

Why does framing denied through both X-Frame-Options and frame-ancestors matter?

X-Frame-Options is the legacy header and frame-ancestors is the modern one. Older browsers read only the first, newer ones prefer the second. Verify it: Run `curl -sI https://example.com | grep -iE 'x-frame-options|frame-ancestors'`.

Why does referrer-Policy set to strict-origin-when-cross-origin matter?

The default leaks full URLs, including query strings that may carry tokens, to every third party a page touches. Verify it: Run `curl -sI https://example.com | grep -i referrer-policy`.

Why does permissions-Policy denying camera, microphone, geolocation and payment matter?

It costs one header and it removes an entire class of prompt from any third-party script or embedded frame. Verify it: Run `curl -sI https://example.com | grep -i permissions-policy`.

Why does a real Content-Security-Policy, with the compromises documented matter?

A missing CSP is the most common gap on otherwise well-built sites. A strict script-src on a statically prerendered app requires a nonce, which forces dynamic rendering, so the honest answer is a locked-down policy everywhere else plus a written note about the tradeoff. Verify it: Run `curl -sI https://example.com | grep -i content-security-policy` and confirm object-src none, base-uri self, frame-ancestors none and a constrained form-action.

Why does secret comparison is timing-safe, with a deliberate delay on failure matter?

A plain equality check returns as soon as two bytes differ, which leaks the length of the matching prefix to anyone who can measure response time across many requests. Verify it: Send 100 requests with a wrong token and 100 with a correct-prefix token and confirm the response time distributions overlap.

Why does every write endpoint runs the same validation pipeline in the same order matter?

Origin, content type, length, rate limit, schema parse, sanitise. Hand-rolling a subset per route is how one endpoint ends up without a rate limit. Verify it: Post to any write endpoint with a foreign Origin header and confirm a 403 before any parsing happens.

Trust, security and accessibility

Trust, security and accessibility covers 14 of the SEO for Solos checklist's implementation checks. Headers, policy pages and keyboard operability. Partly ranking signals, mostly the difference between a site people trust and one they bounce from.

Checks in group

High impact

impact 4 or 5

2.4

Average impact

of 5

Position

of 12 groups

0 of 14

Saved in this browser

Sync across devices

Trust, security and accessibility

Headers, policy pages and keyboard operability. Partly ranking signals, mostly the difference between a site people trust and one they bounce from.

HSTS with a long max-age, includeSubDomains and preload2/S
Why it matters
Without it the first request of every session is plain http and redirectable. With preload the browser never makes that request at all.
How to verify
curl -sI https://example.com | grep -i strict-transport
.
sec-hstsImpact 2/5SmallRead the chapter
X-Content-Type-Options nosniff2/S
Why it matters
Without it a browser may execute a file the server labelled as text, which turns a file upload into a script injection.
How to verify
curl -sI https://example.com | grep -i x-content-type-options
.
sec-nosniffImpact 2/5SmallRead the chapter
Framing denied through both X-Frame-Options and frame-ancestors2/S
Why it matters
X-Frame-Options is the legacy header and frame-ancestors is the modern one. Older browsers read only the first, newer ones prefer the second.
How to verify
curl -sI https://example.com | grep -iE 'x-frame-options|frame-ancestors'
.
sec-frame-denyImpact 2/5SmallRead the chapter
Referrer-Policy set to strict-origin-when-cross-origin2/S
Why it matters
The default leaks full URLs, including query strings that may carry tokens, to every third party a page touches.
How to verify
curl -sI https://example.com | grep -i referrer-policy
.
sec-referrer-policyImpact 2/5SmallRead the chapter
Permissions-Policy denying camera, microphone, geolocation and payment1/S
Why it matters
It costs one header and it removes an entire class of prompt from any third-party script or embedded frame.
How to verify
curl -sI https://example.com | grep -i permissions-policy
.
sec-permissions-policyImpact 1/5SmallRead the chapter
A real Content-Security-Policy, with the compromises documented3/L
Why it matters
A missing CSP is the most common gap on otherwise well-built sites. A strict script-src on a statically prerendered app requires a nonce, which forces dynamic rendering, so the honest answer is a locked-down policy everywhere else plus a written note about the tradeoff.
How to verify
curl -sI https://example.com | grep -i content-security-policy
Then confirm object-src none, base-uri self, frame-ancestors none and a constrained form-action.
sec-cspImpact 3/5LargeRead the chapter
Secret comparison is timing-safe, with a deliberate delay on failure3/S
Why it matters
A plain equality check returns as soon as two bytes differ, which leaks the length of the matching prefix to anyone who can measure response time across many requests.
How to verify
Send 100 requests with a wrong token and 100 with a correct-prefix token and confirm the response time distributions overlap.
sec-timing-safe-compareImpact 3/5SmallRead the chapter
Every write endpoint runs the same validation pipeline in the same order4/M
Why it matters
Origin, content type, length, rate limit, schema parse, sanitise. Hand-rolling a subset per route is how one endpoint ends up without a rate limit.
How to verify
Post to any write endpoint with a foreign Origin header and confirm a 403 before any parsing happens.
sec-api-validation-pipelineImpact 4/5MediumRead the chapter
Every interactive element is keyboard reachable with a visible focus ring3/M
Why it matters
A checklist app that cannot be operated from the keyboard is unusable for part of the audience and fails an automated audit immediately.
How to verify
Tab through the whole page without touching the mouse. Every actionable element must receive focus, in visual order, with a visible ring.
a11y-keyboard-operableImpact 3/5MediumRead the chapter
Semantic landmarks and a skip link as the first focusable element2/S
Why it matters
Without a skip link a keyboard user tabs through 30 navigation items on every page. Landmarks are how a screen reader user jumps straight to the content.
How to verify
Load the page, press Tab once, and confirm the first focused element is a visible skip link pointing at the main landmark.
a11y-landmarks-skip-linkImpact 2/5SmallRead the chapter
16px minimum font size on inputs and 44px minimum tap targets3/S
Why it matters
iOS zooms the viewport when a focused input has a font-size below 16px. It is the single most common mobile defect on otherwise good sites.
How to verify
Open the site on a real iPhone, tap a form field, and confirm the page does not zoom. Then confirm every button is at least 44px tall.
a11y-touch-targetsImpact 3/5SmallRead the chapter
No horizontal page scroll at 375px, with code blocks scrolling inside their own container3/M
Why it matters
A code-heavy site is the most likely kind to break this, and a horizontally scrolling body makes a page feel broken even when nothing is.
How to verify
At 375px width run `document.documentElement.scrollWidth > document.documentElement.clientWidth` in the console and confirm it is false on every template.
a11y-no-horizontal-scrollImpact 3/5MediumRead the chapter
Terms, privacy, licence and refund pages exist, are linked sitewide, and name real processors2/M
Why it matters
A privacy policy that does not name the processors it uses is not a privacy policy. These pages are also a trust signal on a site asking for money.
How to verify
Confirm each page is reachable from the footer of every page and that the privacy policy names every third party that receives data.
trust-legal-pagesImpact 2/5MediumRead the chapter
The consent banner genuinely prevents analytics from loading before consent2/M
Why it matters
A banner that appears after the tracker has already initialised is decorative. It claims compliance it does not deliver, which is worse than having no banner.
How to verify
Open the site in a fresh profile, check the network tab before answering the banner, and confirm zero requests to the analytics host.
trust-consent-gates-analyticsImpact 2/5MediumRead the chapter