Missing Security Headers - Debut Theme

Topic summary

Users are experiencing persistent issues with missing security headers on their Shopify stores using the Debut theme.

The specific headers causing problems are:

  • Referrer Policy
  • Cache Control

One user attempted to resolve this by adding meta tags to the theme’s <head> section, including:

  • <meta name="referrer" content="strict-origin-when-cross-origin">
  • Cache-Control directives (no-store, no-cache, must-revalidate)
  • Pragma and Expires headers

Despite implementing this code, the security header warnings persist (as shown in an attached screenshot). Another user confirmed experiencing the same issue after trying the identical solution.

Status: The problem remains unresolved, with no working solutions identified yet. Both participants are seeking guidance on how to properly implement these security headers in the Debut theme.

Summarized with AI on October 29. AI used: claude-sonnet-4-5-20250929.

Hello,

I am missing two of my required security headers, and I have added some code to address this but it appears that this is still an issue. Here is the code I’ve added:

Has anyone had this issue?

Hi, I added the same code inide the Head but the error has not disappeared. Any help?