Core Web Vitals: what each metric measures and how to fix it
LCP, INP and CLS measure different failures with different causes. Knowing which metric is failing tells you almost exactly where to look.
ZooBieDoo Infotech Engineering TeamRead
Key takeaways
- HSTS and HTTPS everywhere is the baseline.
- Build CSP in report-only mode from real traffic before enforcing.
- Four low-risk headers remove common attack classes in minutes.
- Verify headers after deployments — proxies strip them silently.
Start with transport
Serve everything over HTTPS and add Strict-Transport-Security so browsers refuse to downgrade. Set a modest max-age initially, confirm nothing breaks, then raise it.
Redirect HTTP to HTTPS at the edge rather than in the application, and make sure the redirect goes straight to the canonical host rather than through a chain.
Content Security Policy
CSP is the highest-value header and the most work, because it requires knowing what your pages legitimately load. Start in report-only mode, collect violations from real traffic, then tighten.
The goal is to eliminate inline script and restrict sources to hosts you control or explicitly trust. A policy that ends up allowing everything provides no protection, so it is worth doing properly or not claiming to have done it.
The quick wins
X-Content-Type-Options: nosniff— stops content-type guessing.Referrer-Policy: strict-origin-when-cross-origin— limits URL leakage to third parties.X-Frame-Optionsor a CSPframe-ancestorsdirective — prevents clickjacking.Permissions-Policy— disables browser features the site does not use.
These four take minutes to add and have almost no compatibility risk.
Verifying and monitoring the configuration
Headers are set in one place and lost in another. A CDN configuration change, a new reverse proxy or a framework upgrade can silently strip or override them, and nothing visibly breaks.
Add an automated check to your pipeline or synthetic monitoring that requests the site and asserts the expected headers are present. It is a few lines and it catches regressions the day they happen.
Re-check after every infrastructure change. In practice this is where header configurations are lost, not in application code.
Frequently asked questions
It can if enforced without preparation, which is why report-only mode exists. Collect violations from production traffic for a period, resolve them, then enforce.
Not directly. HTTPS is a ranking signal, and a site compromised through a preventable vulnerability suffers considerably worse consequences than a ranking adjustment.
Whoever owns the edge configuration usually the CDN or web server layer rather than the application. Keeping them in infrastructure code means they are reviewed and cannot be lost in a deployment.
