Ngaahi header malu ʻi he 2026: ko e uepisaiti ʻe 3 ʻi he 4 ʻoku ʻikai ha Content-Security-Policy

Ko e ngaahi header malu ko ha ngaahi laine siʻi pē ʻi he tali ʻa e sēvea ʻoku nau tala ki he palausa pe ʻe anga fēfē hono fakamaʻumaʻu ʻo ha peesi. ʻOku ʻikai ha totongi ke fekau ai, ʻoku nau maluʻi ʻa e kau ʻaʻahi mei he clickjacking, fakamatala fefiofi mo hono huʻi atu ha sikuliputi, pea ko ha konga ia ʻo e maaka malu ʻi he ʻatita kotoa pē ʻa LANGR SEO. ʻI heʻemau fakamatala, ko e mōtule foki ia ʻoku māʻulalo taha hono maaka: ko e lotomālie ko e 40 mei he 100.

Ko e ngaahi fika ni ʻoku haʻu mei he ʻatita fakamuimui taha ʻo e uepisaiti ʻe 94,853 naʻa nau tali ki heʻemau sikena ʻi he vahaʻa ʻo ʻEpeleli mo ʻOkatopa 2026.

Ko e uepisaiti ʻe fiha ʻoku fekau ʻa e header takitaha

Header	Uepisaiti ʻoku nau fekau ia
X-Content-Type-Options	47.6%
X-Frame-Options	44.8%
Strict-Transport-Security (HSTS)	41.9%
Referrer-Policy	25.6%
Content-Security-Policy	23.5%
Permissions-Policy	8.4%

ʻOku ʻikai ha header ʻe taha ʻe aʻu ki he vaeua ʻo e ngaahi uepisaiti. ʻOku ʻikai ha HSTS ʻi he 58.1%, ʻa ia ʻoku ʻuhinga ʻe kei lava ke fakasiʻisiʻi ʻa e ʻaʻahi ʻuluaki ki he HTTP angamaheni. Ko e toe meʻa, ko e 17.7% ʻo e ngaahi uepisaiti ʻoku ʻikai pē te nau fakahinohino ʻa e HTTP ki he HTTPS.

Ko hoʻo palafōmu ʻoku ne fili ʻa e konga lahi taha

Palafōmu	Uepisaiti	ʻIkai ha Content-Security-Policy
Shopify	4,411	2.6%
Squarespace	348	85.3%
WordPress	25,703	83.3%
PrestaShop	1,205	90.4%
OpenCart	455	94.3%
Wix	119	97.5%
ʻIkai ha CMS naʻe ʻilo	60,583	77.3%

ʻOku fekau ʻe Shopify ha CSP ki he falekoloa kotoa pē, ko ia ʻoku meimei ʻikai ha uepisaiti Shopify ʻe taha ʻoku masiva ai. ʻI he WordPress mo e lahi taha ʻo e ngaahi founga falekoloa ʻoku tauhi pē ʻe he tokotaha ʻoʻona, ʻoku fakatuʻunga ʻa e ngaahi header ʻi he kautaha tauhi uepisaiti pe ha plugin, pea ko e lahi taha ʻo e ngaahi uepisaiti ʻoku ʻikai te nau maʻu ia. Kapau ʻoku ke ngāue ʻaki ʻa e WordPress, ʻoku mahuʻinga ange ʻa e fokotuʻu ʻo hoʻo tauhi uepisaiti ʻi hoʻo tēma ʻi heni.

Ko e ngaahi laine ʻe nima ʻoku nau tāpuni ʻa e konga lahi ʻo e vahaʻa

ʻOku malu ʻa e ngaahi header ni ki he meimei uepisaiti kotoa pē pea ʻe lava ke tānaki atu ʻi he sēvea uepi, ha CDN hangē ko Cloudflare pe ha plugin malu:

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

ʻOku fiemaʻu ʻe ha Content-Security-Policy ha tokanga lahi ange, koeʻuhi ʻe lava ʻe ha tuʻutuʻuni fefeka ʻo taʻofi hoʻo ngaahi sikuliputi pē ʻaʻau. Kamata ʻaki ʻa e Content-Security-Policy-Report-Only, vakai ki he meʻa te ne taʻofi, pea hiki ki he header moʻoni ʻi he taimi ʻoku maʻa ai ʻa e ngaahi lipooti.

ʻOku uesia ʻe he ngaahi header malu ʻa e tuʻunga ʻi he kumi?

ʻIkai fakahangatonu. Kuo fakapapauʻi ʻe Google ʻa e HTTPS ko ha fakaʻilonga tuʻunga, ka ʻoku ʻikai ko e ngaahi header taki taha. Neongo ia, ʻoku nau mahuʻinga ki he SEO ʻi he moʻui moʻoni: ko ha uepisaiti kuo hake ʻo huʻi ki ai ha ngaahi fehokotaki spam ʻoku vave ʻene mole hono tuʻunga, pea ʻoku fakatokanga ʻe he ngaahi palausa ki he kau ʻaʻahi ke ʻalu mamaʻo mei he ngaahi peesi ʻoku ne fakahū mai ha fakamatala taʻemalu.

Fakahoko ha ʻatita SEO taʻetotongi ke sio pau pe ko e fē ngaahi header ʻoku fekau ʻe ho uepisaití, mo ha fakalelei mateuteu ki he header takitaha ʻoku ʻikai ai. Ko e ngaahi foʻi lea ʻoku fakamatalaʻi ia ʻi he SEO mei he A ki he Z.

Founga: ko e ʻatita kakato fakamuimui taha ʻo e tomeni takitaha, uepisaiti ʻe 94,853 ʻoku ʻi ai hano ola header, naʻe tānaki mei ʻEpeleli ki ʻOkatopa 2026, ko e lahi taha ko e ngaahi tomeni foʻou mo e tomeni ʻa e ngaahi pisinisi iiki ʻi he ngaahi māketi fakafonua ʻe 15. Ko e ngaahi palafōmu ʻoku siʻi hifo ʻi he uepisaiti ʻe 100 naʻe ʻikai fakakau, pea ʻoku ʻikai fakahingoa ha tomeni pē ʻe taha.