News
AMP vs Signed HTTP Exchanges for Public Pages
March 2, 2022
AMP vs Signed HTTP Exchanges for public pages is two ways a third party might serve a copy of your HTML. AMP is a constrained HTML dialect historically cached on a Google origin (cdn.ampproject.org and cousins) — extra CSP, extra origin, extra supply chain. Signed HTTP Exchanges (SXG) let a cache serve a cryptographically signed snapshot that still attributes to your origin in supporting browsers. Neither is HTTPS, HSTS, or a WAF. A brochure can stay on first-party HTML at the CDN you already pay for. RoastMyOpsec does not score AMP, does not fetch SXG certificates, and does not treat missing AMP as an F.
The practical difference
AMP is a format plus a cache network. SXG is a signature on an HTTP exchange so a prefetch cache can show your origin's URL. HTTP/3 is transport. Cache-Control is freshness. Alt-Svc advertises h3 — not an AMP cache.
Keeping AMP 'for SEO' in 2026 still adds a second HTML pipeline and a second origin unless you self-host AMP without the Google cache.
How to choose a packaging plan
Brochure: first-party HTML, Cache-Control, HTTP/2 and HTTP/3 on your hostname. Must stay in a partner prefetch program: SXG only after cert and cache-key review — still not a roast finding if missing. Still on AMP: prefer first-party AMP or migrate off; do not treat the Google cache as your WAF. Personalized HTML: do not SXG-sign Set-Cookie pages.
| Channel | Who serves the HTML | Brochure default | Takeaway |
|---|---|---|---|
| First-party CDN | Your hostname | Usual win | See HTTP/2 vs HTTP/3 |
| AMP cache | A third-party AMP origin | Skip unless required | Extra origin and CSP |
| Signed HTTP Exchange | A cache with your signature | Skip unless you prefetch | Not a roast F if missing |
| Cache-Control | Freshness of your response | Always set it | See CDN cache keys |
When AMP or SXG still wins
AMP wins only when a partner still requires the dialect. SXG wins when a documented prefetch program needs signed snapshots of public, non-personalized pages. First-party HTML still wins for a brochure. Missing both is healthy.
What the roast can prove
HTTPS and Cache-Control vs cookies can surface. AMP and SXG are not scored. Confirm amphtml links and SXG certs yourself. Pair with consent-based scanning — do not treat a Google cache URL as a site you own.
Common mistakes
The first mistake is treating the AMP cache as your origin for cookies and CSP.
The second mistake is signing personalized HTML as an SXG.
The third mistake is requiring AMP or SXG as an OPSEC finding.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is missing AMP a vulnerability?
- No. It is a packaging choice. Missing AMP is not a roast F.
- Does SXG replace HTTPS?
- No. The exchange is still HTTP over TLS at the cache. SXG adds a signature so a prefetch can show your origin URL.
- Does RoastMyOpsec score AMP or SXG?
- No. It does not fetch AMP caches or SXG certificates. Confirm those pipelines yourself.