Security Headers and Performance: The Real Story
Security headers (CSP, HSTS, X-Frame-Options, Permissions-Policy, Referrer-Policy) add between 200 bytes and several kilobytes to each HTTP response. The common assumption is that they add payload and slow things down. The reality: the headers themselves have negligible performance impact — but a misconfigured Content-Security-Policy can catastrophically break your site and destroy Core Web Vitals metrics.
Header Size Impact: Negligible
| Header | Typical Size | Performance Impact |
|---|---|---|
| Strict-Transport-Security | ~70 bytes | None measurable |
| X-Frame-Options | ~30 bytes | None measurable |
| X-Content-Type-Options | ~35 bytes | None measurable |
| Referrer-Policy | ~50 bytes | None measurable |
| Content-Security-Policy | 500–10,000+ bytes | None from size — but see CSP gotchas |
The CSP Performance Trap
CSP is the only security header that can cause real performance degradation — not from header size, but from blocking resources your site needs. A CSP that is too restrictive will block scripts, styles, or fonts your site depends on. If the blocked resource is your LCP image’s CDN host or a critical CSS file, the impact can be severe. Always start with Report-Only mode:
# Nginx — use Report-Only first to audit without enforcing
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self' https://js.stripe.com https://www.googletagmanager.com; report-uri /csp-violations" always;HSTS: An Unexpected Performance Benefit
HTTP Strict Transport Security has a measurable positive performance impact after the first visit. With HSTS, the browser eliminates the HTTP→HTTPS redirect for returning visitors — saving one full round-trip (50–300ms depending on geography). Once preloaded, the redirect is eliminated even on first visits for Chrome and Firefox users.
Recommended Header Configuration for WordPress
# Nginx server block
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
# Start permissive CSP — tighten after auditing Report-Only violations
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:;" always;FAQ
Do security headers affect SEO?
Directly: no — security headers are not a Google ranking factor. Indirectly: a misconfigured CSP that blocks your LCP image or critical JavaScript will hurt Core Web Vitals, which does affect ranking. Always measure CWV metrics after adding CSP.
Which security header should I add first?
Start with HSTS (immediate performance and security benefit), X-Content-Type-Options, and X-Frame-Options — these carry essentially zero risk of breaking anything. Add CSP last, starting with Report-Only mode to audit violations before enforcing.