I’ve been running an SEO+security audit (optimizing the site for AI crawlers) and found 3 response header items that are controlled by the platform rather than theme settings:
Strict-Transport-Security: max-age=7889238 is about 91 days. The widely recommended value is max-age=31536000; includeSubDomains (1 year), which is also the minimum HSTS preload lists expect
No Referrer-Policy header at all
No Permissions-Policy header at all
As far as I can tell, none of these can be set from theme.liquid or anywhere in the theme (Shopify manages the response headers).
My questions for the community:
Has anyone managed to get the HSTS max-age extended on their store?
Is there any supported way to add Referrer-Policy and Permissions-Policy headers?
Shopify manages those headers at the edge, so there’s no theme-level way to change them. I haven’t seen Plus stores get custom values either - you can ask support but the answer is usually no.
Two partial workarounds:
Referrer-Policy: drop <meta name="referrer" content="strict-origin-when-cross-origin"> in theme.liquid head. Carries most of the same behavior even if scanners flag the missing header.
Permissions-Policy: there’s a <meta http-equiv="Permissions-Policy"> form floating around, but browser support is spotty (Chromium only, partial directives). I wouldn’t rely on it as a real fix.
Side note on the AI crawler angle - GPTBot, PerplexityBot, ClaudeBot etc don’t actually gate on Permissions-Policy or Referrer-Policy. What moves AIO is robots.txt allow lines, an llms.txt file at the root, and JSON-LD on key pages. The headers mostly help with browser-side security posture, not crawler eligibility.
Agreed on all of this, and worth adding the mechanics since they changed right around when this was posted: Shopify made /agents.md canonical (~May 20-28), with /llms.txt just redirecting to it now. If you’re setting one up, it has to be a theme Liquid template - templates/agents.md.liquid under Online Store → Themes → Edit code - not a root-level static file or a redirect, both get silently overridden by Shopify’s own generated default now.
(Disclosure: I build AEO Pro - hit this exact mechanic fixing our own publish feature.)
Great discussion on Shopify’s security headers and AI crawler optimization. Just as a well-designed pedestrian bridge improves safe and efficient access, proper platform-level security and SEO configurations help create a stronger, more reliable website experience.
I’d separate “security header score” from “AI crawler visibility” here. You’re right that HSTS / Referrer-Policy / Permissions-Policy are Shopify edge-level controls, so I wouldn’t burn much time trying to force them from Liquid beyond the referrer meta workaround.
For AI visibility, the higher-leverage work is making sure /agents.md, robots rules, clean JSON-LD, crawlable product/collection pages, and page speed are solid. I wrote up the Shopify-specific checklist here if useful: Shopify AI Visibility Guide (2026)