Response headers

Every time a browser loads a page or a file from your site, the answer carries a few lines of technical information called response headers. They tell the browser how long to keep a copy, that the site is https only, whether other sites may embed it, and more. Most sites never need to change them. If your IT team, a security review or a partner asks for a specific header, this is where you add it.

Open Settings, then Headers under Hosting.

Headers we always send

The Default headers list shows what every page of your site carries. You cannot remove these. If you add a custom header with the same name, your value replaces ours.

Add a header (Business plan)

1. Under Custom headers, type the Path. Use /* for the whole site, /blog/* for everything under a folder, or /about for one page.
2. Pick the Name from the list. Only the names in the list are allowed.
3. Type the Value exactly as the person who asked for it wrote it.
4. Press Add. The header reaches visitors within a few minutes.

If two headers have the same name, the one with the more specific path wins. A header on /blog/* beats one on /* for pages under the blog. A folder rule like /blog/* does not cover the folder page /blog itself; add a second row for it if you need to.

Remove a header

Open the row's menu (the three dots) and press Remove. Removing works on every plan.

Names you can use

Permissions-Policy, Referrer-Policy, Strict-Transport-Security, X-Frame-Options, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Reporting-Endpoints, X-Content-Type-Options and X-Robots-Tag.

Content-Security-Policy is not in the list. Your pages already carry a content security policy that we build for you from the integrations and custom code you have added; a second one typed by hand would break them.

Good to know

• A wrong value can stop parts of your site from working. Cross-Origin-Embedder-Policy: require-corp is the usual culprit: it can stop embedded videos and maps from loading. Check your site after adding it.
• X-Robots-Tag: noindex on a path hides those pages from search engines. It is added to, never replaces, the noindex we put on free contentmetric.com addresses.
• If your site moves to the Free or Pro plan, your custom headers stop being sent but stay in the list. They are sent again when the site is back on Business.
• A copy of the site starts with no custom headers.