Security headers that matter

Security headers are short instructions your server sends with each HTML response. Browsers use them to keep connections on HTTPS, limit which scripts can run, reduce click-tricks, and limit how much address information leaks to other sites. They are not a full security programme and they will not patch a vulnerable plugin — but they are a solid, low-cost baseline for almost every public website.

Check yours with the security headers checker.

How to read a result

Our checker reports what the response actually sent on the page you entered. Headers can differ between the home page and an app path, or between the CDN edge and the origin. If you use a reverse proxy, set headers there so every path inherits them. A “Worth a look” result usually means a useful header is missing rather than an active exploit.

HSTS — stick to HTTPS

HTTP Strict Transport Security tells browsers to use HTTPS only for your domain for a set time. A common production value looks like Strict-Transport-Security: max-age=31536000; includeSubDomains. Some sites later add preload once they understand the consequences of submitting to the browser preload list.

Only enable HSTS once HTTPS works on the whole site (and on every subdomain covered by includeSubDomains). Otherwise you can lock browsers out of a host that still needs HTTP. HSTS does not replace a valid certificate; it only stops browsers from casually trying HTTP after they have seen the header.

Content Security Policy (CSP)

CSP limits where scripts, styles, images, fonts, connects and frames may load from. A tight policy blocks many cross-site scripting paths because injected script from a random host simply will not run. A policy that is too tight can break your own theme, analytics, payment widget or map embed.

Practical approach for a small site:

• Inventory the third parties you genuinely need.
• Start in report-only mode if your stack supports it, and watch for blocked loads.
• Prefer allow-lists of hosts over broad unsafe-inline and unsafe-eval where you can.
• Tighten gradually rather than pasting a strict example from the internet onto a live shop.

CSP is powerful and easy to get wrong. Change it carefully and re-test forms, checkout and admin screens.

X-Frame-Options and frame-ancestors

X-Frame-Options: SAMEORIGIN stops other sites showing your pages inside their frames. The modern CSP equivalent is frame-ancestors 'self' (or a short allow-list). That reduces clickjacking, where a visitor thinks they are clicking your UI but are clicking someone else’s layer on top.

If you deliberately embed your own pages in a partner site, list that partner explicitly instead of opening framing to the whole web.

X-Content-Type-Options

X-Content-Type-Options: nosniff tells browsers not to guess file types when the server already declared one. It is one line, safe on almost every site, and blocks a class of content-sniffing attacks. If you only add one header today, this is a good candidate alongside a sensible Referrer-Policy.

Referrer-Policy

This limits what your site tells other sites about the page a visitor came from when they follow a link. A sensible default is strict-origin-when-cross-origin: full path on your own site, trimmed origin when going elsewhere over HTTPS, and nothing when downgrading to HTTP. Avoid unsafe-url, which can leak full paths and query strings (sometimes including tracking tokens) to third parties.

Permissions-Policy (optional extra)

Permissions-Policy (formerly Feature-Policy) can turn off browser features your site does not need, such as camera, microphone or geolocation. If you never use them, disabling them reduces the impact of a future script injection. It is optional; get the core five headers right first.

What headers do not do

Headers do not patch vulnerable plugins, stop phishing emails, replace backups, or prove a site is “safe”. They harden how browsers behave when someone loads your pages. Combine them with HTTPS hygiene — see SSL and Not secure warnings — and routine updates.

Practical next steps

1. Run the security headers checker.
2. Add nosniff and a sensible Referrer-Policy first — low risk.
3. Add framing protection (X-Frame-Options or frame-ancestors).
4. Turn on HSTS only after HTTPS is clean everywhere you need.
5. Introduce CSP gradually, starting report-only if you can.

Re-check after each change. Then run the free scan for the wider passive pass.

Informational only. Not a security audit, legal advice or a guarantee.

All guides · Free scan