Software development

HTTPS and security headers for business websites in 2026

8 min readBy Jaskirat Singh Talwar

A brass padlock beside a laptop and a notebook on a wooden desk

Every business website should run only on HTTPS, redirect all plain HTTP to it, and send a small set of security headers: Strict-Transport-Security (HSTS), a Content Security Policy, X-Content-Type-Options, Referrer-Policy, a frame-ancestors rule and a Permissions-Policy. In 2026 HTTPS is no longer optional in practice: Chrome now warns before opening public sites that do not use it, and certificate lifetimes are getting shorter, so renewal must be automatic. HTTPS helps search only lightly; the main reasons are security and trust.

Key takeaways

  • Google called HTTPS "a very lightweight signal" when it added it to ranking in August 2014, and its page experience guide says that, apart from Core Web Vitals, other page experience aspects do not directly help a site rank higher.
  • Google planned to turn on Chrome's "Always Use Secure Connections" setting for public sites by default in Chrome 154 (October 2026); Chrome then asks before the first visit to a public site that does not use HTTPS.
  • The CA/Browser Forum schedule cuts the maximum certificate lifetime from 398 days to 47 days between March 2026 and March 2029; Let's Encrypt moves its default certificates to 64 days in February 2027 and 45 days in February 2028.
  • HSTS tells browsers to use HTTPS only; preloading it is hard to undo, so read the hstspreload.org requirements before adding preload.
  • OWASP's current advice is to stop sending X-XSS-Protection (or set it to 0) and to drop Expect-CT, which is deprecated.

What does HTTPS actually protect?

HTTPS is HTTP over TLS. It encrypts the connection between the visitor's browser and your server, so anyone on the network path (public Wi-Fi, a compromised router, an internet provider) cannot read or change what is sent. That covers form submissions, logins, payment pages, and also ordinary pages: without TLS an attacker can inject scripts or swap a phone number on a page that looks harmless.

The "S" was once explained as SSL, the older protocol. Modern sites use TLS, and "SSL certificate" survives only as a product name. HTTPS proves the visitor reached your domain; it does not prove your business is trustworthy, and it does not protect a site that is itself compromised. That is why it is the baseline, not the whole of website security.

Does HTTPS still help SEO?

A little, and it is not the reason to do it. Google's 2014 announcement said HTTPS was "a very lightweight signal", affecting "fewer than 1% of global queries" and carrying less weight than signals such as high-quality content. Google's current page experience guide lists "Are your pages served in a secure fashion?" in its self-assessment, says Core Web Vitals are used by its ranking systems, and says other page experience aspects do not directly help a site rank higher.

What HTTPS does affect is the visitor. From Chrome 154, scheduled for October 2026, Google planned to enable "Always Use Secure Connections" for public sites for all users. Chrome then shows a warning before the first visit to a public site that does not support HTTPS, with "Continue to site" and "Return" buttons. A warning screen on your home page costs you leads whatever your ranking.

Why do certificates need automatic renewal now?

Because they will soon expire faster than anyone can renew them by hand. The CA/Browser Forum approved ballot SC-081v3 in April 2025, reducing the maximum validity of public TLS certificates from 398 days to 47 days in steps from March 2026 to March 2029. Let's Encrypt has published its own plan:

Date Let's Encrypt change
13 May 2026 Opt-in tlsserver profile issues 45-day certificates
10 February 2027 Default classic profile moves to 64-day certificates, 10-day authorisation reuse
16 February 2028 classic profile moves to 45-day certificates, 7-hour authorisation reuse

Let's Encrypt says renewing at a hard-coded 60-day interval "will no longer be sufficient". Use a client that supports ACME Renewal Information (ARI), or renew at about two-thirds of the certificate's lifetime, and set up monitoring that alerts you when a renewal does not happen. Managed certificate services on cloud platforms renew for you; check that the domain validation they depend on (usually a DNS record) is still in place.

Which security headers should a business site send?

Six headers do most of the work. These are the recommendations from the OWASP HTTP Headers Cheat Sheet and MDN:

Header What it does Typical value
Strict-Transport-Security Browser uses HTTPS only for this host max-age=31536000 (add includeSubDomains when every subdomain has HTTPS)
Content-Security-Policy Limits where scripts, styles, frames and other resources can load from Built per site; start with default-src 'self'
X-Content-Type-Options Stops the browser guessing file types nosniff
Referrer-Policy Limits the URL detail sent to other sites strict-origin-when-cross-origin
Frame control Stops other sites framing yours (clickjacking) CSP frame-ancestors; X-Frame-Options for older browsers
Permissions-Policy Turns off browser features you do not use camera=(), microphone=(), geolocation=()

OWASP also recommends: do not set X-XSS-Protection, or set it to 0, and rely on a Content Security Policy instead; remove Expect-CT, which is deprecated; and remove or neutralise headers such as X-Powered-By that reveal your software. For HTML, send an accurate Content-Type with the character set.

The cross-origin isolation headers (COOP, COEP, CORP) are worth adding for applications that need them, but on a marketing site with embedded maps, videos and booking widgets, Cross-Origin-Embedder-Policy: require-corp can break third-party content. Test before you enforce.

How do you add HSTS without locking yourself out?

Roll it out in stages. MDN notes that browsers ignore the HSTS header over plain HTTP, and that it only takes effect after the first secure visit, which is why preloading exists. A safe order:

  1. Serve every page over HTTPS and 301-redirect HTTP to HTTPS on the same host.
  2. Send HSTS with a short max-age (for example a few minutes), check that nothing breaks, then raise it.
  3. Move to one year (max-age=31536000).
  4. Add includeSubDomains only once every subdomain, including old mail, staging and marketing tools, works over HTTPS.
  5. Consider preload last.

hstspreload.org requires a valid certificate, the HTTP-to-HTTPS redirect, HTTPS on all subdomains, and a header on the base domain with max-age of at least 31536000, includeSubDomains and preload. It warns that inclusion "cannot easily be undone" and that removal "tends to be slow and painful". OWASP's example value is max-age=63072000; includeSubDomains; preload, with the same warning.

What does a Content Security Policy look like in practice?

A CSP is a list of allowed sources per resource type. It is the most useful header and the one most likely to break a page, because every analytics tag, consent banner, chat widget and embedded video must be listed. A simplified shape:

Content-Security-Policy: default-src 'self';
  script-src 'self' https://www.googletagmanager.com;
  img-src 'self' data: https:;
  object-src 'none'; base-uri 'self';
  form-action 'self'; frame-ancestors 'self';
  upgrade-insecure-requests

Start with Content-Security-Policy-Report-Only, which reports violations without blocking, fix what it reports, then switch to the enforcing header. Prefer hashes or nonces for inline scripts over 'unsafe-inline'. Every new marketing tag then becomes a CSP change, so agree who owns the policy.

What headers does impingesolutions.com send?

Our site runs on S3 and CloudFront, as described in our WordPress to Astro on AWS migration write-up. A curl -sI request to the home page on 29 October 2026 returned:

  • strict-transport-security: max-age=31536000 (one year; no includeSubDomains or preload, so the domain is not set up for the preload list);
  • an enforced content-security-policy with default-src 'self', SHA-256 hashes for inline scripts, an allow-list for Google Tag Manager, Cookiebot, Calendly and Cloudflare Turnstile, object-src 'none', base-uri 'self', form-action 'self', frame-ancestors 'self' and upgrade-insecure-requests (styles still allow 'unsafe-inline');
  • x-content-type-options: nosniff;
  • referrer-policy: strict-origin-when-cross-origin;
  • x-frame-options: SAMEORIGIN;
  • permissions-policy: camera=(), microphone=(), geolocation=().

Plain HTTP requests get a 301 redirect, and the bare domain redirects to https://www.impingesolutions.com/. You can run the same curl -sI https://your-domain/ check on your own site in a few seconds.

Where do you set these headers?

Wherever the response is produced. On a CDN such as CloudFront, a response headers policy adds them at the edge for every file. On a server, the web server configuration (Apache, Nginx, IIS) sets them. On managed WordPress or site builders, a security plugin or the host's settings may be the only option, and some hosts do not allow a custom CSP at all. If you are planning a move, include headers in the website redesign and migration checklist, because a new host or CDN does not carry them over automatically. If you want help with hosting, certificates or headers, see our website solutions.

FAQ

Is a free certificate as secure as a paid one?

For the connection, yes. Encryption strength comes from the TLS version and settings on your server or CDN, not from the price of the certificate; what you pay for elsewhere is the product around it, such as support or other validation types.

Will HSTS break my site?

Only if some part of the domain cannot serve HTTPS. Start with a short max-age, add includeSubDomains only when every subdomain works over HTTPS, and leave preload until last.

Do I still need X-XSS-Protection?

No. OWASP recommends not setting it, or setting it to 0, and using a Content Security Policy instead.

What happens if my certificate expires?

Browsers show a full-page security error and most visitors leave. With lifetimes falling towards 47 days by 2029, automate renewal and set an alert for failed renewals.

Does Google rank HTTPS sites higher?

HTTPS is a lightweight ranking signal, according to Google's 2014 announcement. Content quality and Core Web Vitals matter more; HTTPS matters most for visitor trust and browser warnings.

Sources (9 links)
Share this article