Security headers are HTTP response headers that tell the browser to enforce additional protections on your behalf — a low-effort, high-value layer of defense that most sites still don’t configure.
The essentials
- Content-Security-Policy: restricts which sources scripts, styles, and other resources can load from, significantly limiting the impact of an XSS vulnerability
- Strict-Transport-Security (HSTS): forces browsers to only ever connect via HTTPS, even if a visitor types
http:// - X-Content-Type-Options: nosniff: stops browsers from guessing (and misinterpreting) a file’s content type
- X-Frame-Options / frame-ancestors: prevents your site being embedded in a malicious iframe (clickjacking)
- Referrer-Policy: controls how much referrer information is leaked to other sites when a visitor navigates away
Checking your current headers
Several free online header-scanners will grade your site’s current configuration and list exactly which headers are missing.
FAQ
Will adding these headers break anything?
A strict Content-Security-Policy can break inline scripts or third-party embeds if not configured carefully — test in a staging environment first, and roll out CSP in report-only mode before full enforcement.