Kanun tsaro (security headers) a 2026: shafuka 3 cikin 4 ba su da Content-Security-Policy
Kanun tsaro (security headers) a 2026: shafuka 3 cikin 4 ba su da Content-Security-Policy
Kanun tsaro wasu 'yan layuka ne a cikin amsar sabar da ke gaya wa burauza yadda za ta yi tsauri da shafi. Aika su ba ya kashe komai, suna kare masu ziyara daga clickjacking, abun ciki mai gauraye da kutsen rubutun (script injection), kuma suna cikin makin tsaro a kowane binciken LANGR SEO. A cikin bayananmu, su ne kuma ɓangaren da ya fi ƙarancin maki: matsakaici (median) 40 cikin 100.
Alkaluman sun fito ne daga bincike na ƙarshe na shafukan yanar gizo 94,853 da suka amsa na'urar bincikenmu tsakanin Afrilu da Oktoba 2026.
Shafuka nawa ne ke aika kowane kanu
| Kanu | Shafukan da ke aika shi |
|---|---|
| X-Content-Type-Options | 47.6% |
| X-Frame-Options | 44.8% |
| Strict-Transport-Security (HSTS) | 41.9% |
| Referrer-Policy | 25.6% |
| Content-Security-Policy | 23.5% |
| Permissions-Policy | 8.4% |
Babu kanu ko ɗaya da ya kai rabin shafuka. HSTS ba ya nan a 58.1%, wanda ke nufin har yanzu ana iya sauke ziyarar farko zuwa HTTP na yau da kullum. Bugu da ƙari, 17.7% na shafuka ba sa tura HTTP zuwa HTTPS ko kaɗan.
Dandalinku ne ke yanke mafi yawan abin
| Dandali | Shafuka | Babu Content-Security-Policy |
|---|---|---|
| Shopify | 4,411 | 2.6% |
| Squarespace | 348 | 85.3% |
| WordPress | 25,703 | 83.3% |
| PrestaShop | 1,205 | 90.4% |
| OpenCart | 455 | 94.3% |
| Wix | 119 | 97.5% |
| Ba a gano CMS ba | 60,583 | 77.3% |
Shopify yana aika CSP ga kowane shago, don haka kusan babu shafin Shopify da ba shi da shi. A WordPress da yawancin tsarin shaguna da mutum ke ɗaukar nauyinsu da kansa, kanun sun dogara ne ga mai ɗaukar nauyi ko wani plugin, kuma yawancin shafuka ba sa samun su har abada. Idan kuna amfani da WordPress, saitin ɗaukar nauyin shafinku ya fi jigon (theme) ku muhimmanci a nan.
Layuka biyar da ke rufe mafi yawan gibin
Waɗannan kanun suna da aminci ga kusan kowane shafi, kuma ana iya ƙara su a sabar yanar gizo, a CDN kamar Cloudflare ko ta hanyar plugin na tsaro:
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()Content-Security-Policy yana buƙatar ƙarin kulawa, domin manufa mai tsauri na iya toshe rubutun naku na kanku. Ku fara da Content-Security-Policy-Report-Only, ku duba abin da zai toshe, sannan ku koma kan ainihin kanun idan rahotanni sun tsabtace.
Shin kanun tsaro suna shafar matsayi a sakamakon bincike?
Ba kai tsaye ba. Google ya tabbatar da HTTPS a matsayin alamar matsayi, amma ba kowane kanu ɗaya ba. Duk da haka suna da muhimmanci ga SEO a aikace: shafin da aka yi wa kutse aka saka masa hanyoyin haɗin spam yana rasa matsayi da sauri, kuma burauzoyi suna gargaɗin masu ziyara su nisanci shafukan da ke loda abun ciki mara tsaro.
Gudanar da binciken SEO kyauta don ganin daidai waɗanne kanu shafinku ke aikawa, tare da gyara a shirye ga kowanne da ba ya nan. An bayyana kalmomin a cikin SEO daga A zuwa Z.
Hanyar aiki: bincike cikakke na ƙarshe ga kowane yanki, shafukan yanar gizo 94,853 masu sakamakon kanu, an tattara daga Afrilu zuwa Oktoba 2026, galibi sababbin yankuna da aka yi wa rajista da yankunan ƙananan kasuwanci a kasuwannin ƙasashe 15. An cire dandali masu ƙasa da shafuka 100, kuma ba a ambaci sunan kowane yanki ɗaya ba.