Security headers explained: the six worth setting

Security headers are instructions your server sends with every page. They ask the browser to behave more safely: always use https, refuse to run unexpected scripts, refuse to be framed by other sites, and so on. They are cheap to add and make several common attacks harder. A missing header does not mean your site is hacked; it means there is an easy hardening step left.

1. Strict-Transport-Security (HSTS)

Tells the browser to use https for your site for a set time, even if someone types or clicks an http link. This prevents an attacker on the same network from quietly downgrading the connection.

Strict-Transport-Security: max-age=31536000; includeSubDomains

max-age is in seconds; a year is common, and six months is a reasonable minimum. Only add includeSubDomains when every subdomain supports https. The preload flag and the browser preload list are hard to undo, so add them only when you are sure.

2. Content-Security-Policy (CSP)

Lists where the page may load scripts, styles, images, fonts and frames from. If an attacker manages to inject a script tag pointing at their own domain, a good CSP stops the browser from loading it.

Content-Security-Policy: default-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'

CSP is the most powerful header and the easiest to get wrong, because it can block your own analytics, fonts, or embedded widgets. Start with Content-Security-Policy-Report-Only, which reports violations without blocking anything, then switch to the enforcing header once the reports are clean. Allowing 'unsafe-inline' scripts weakens protection against injected scripts; nonces or hashes are stronger when your framework supports them.

3. X-Frame-Options, or CSP frame-ancestors

Stops other sites from showing your pages inside a frame, which is how clickjacking works: your real page is shown invisibly on top of a decoy, and the visitor clicks your buttons without knowing.

X-Frame-Options: DENY

Use SAMEORIGIN if your own site frames its pages. The modern replacement is the CSP rule frame-ancestors; sending both is fine and covers older browsers.

4. X-Content-Type-Options

Tells the browser not to guess a file’s type. Without it, a browser might treat an uploaded text or image file as a script. There is only one valid value.

X-Content-Type-Options: nosniff

5. Referrer-Policy

Controls how much of the current address is sent to other sites when a visitor clicks a link or the page loads a resource. Full addresses can contain search terms, account pages, or tokens.

Referrer-Policy: strict-origin-when-cross-origin

This sends only your domain to other sites and the full address within your own site. Modern browsers already default to it, but setting it explicitly protects visitors on older browsers. Avoid unsafe-url.

6. Permissions-Policy

Turns off browser features your site does not use, so an injected script or an embedded frame cannot ask for them.

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

Leave out any feature your site genuinely needs, or allow it only for your own origin, for example geolocation=(self).

Headers that give information away

X-Powered-By and a Server header with a version number (for example nginx/1.18.0) tell everyone which software and version you run. That is not a vulnerability by itself, but it makes it easier to match your site with known exploits for outdated versions. Most frameworks and servers can hide them.

Headers you can skip

X-XSS-Protection controlled a filter that modern browsers have removed. Leave it out, or set it to 0, and rely on CSP instead.

Where to set them

Security headers can be added in your web server (nginx, Apache, Caddy), your CDN or hosting control panel, or your application framework. After you change them, test the live site: redirects, CDNs and caches sometimes strip or override headers. The free security headers checker shows which of the six your homepage sends and flags weak values.