Security Headers
Website Security Headers Guide — Protect Your Site in 10 Minutes
Security headers are your website's invisible shield. They tell browsers how to handle your content safely — blocking XSS, clickjacking, and MIME sniffing. Best part? Most take under 10 minutes to set up.
What Are Security Headers?
Every time someone visits your website, your server sends back HTTP response headers — metadata that tells the browser what to do. Security headers are a subset of these that instruct the browser to enforce specific safety rules.
Think of them as the bouncer at a club: they decide what scripts can run, who can frame your pages, and how connections should be encrypted. Without them, your site is more vulnerable to common web attacks.
The 6 Security Headers That Matter
1. HSTS (HTTP Strict-Transport-Security)
Strict-Transport-Security: max-age=31536000; includeSubDomains
HSTS forces browsers to always use HTTPS — even if the user types "http://" or clicks an old link. Once a browser sees this header, it refuses to connect over plain HTTP for the duration you specify. This prevents SSL stripping and man-in-the-middle downgrade attacks.
Set max-age to at least one year (31536000 seconds). If you own subdomains, add includeSubDomains.
2. CSP (Content-Security-Policy)
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:
CSP is the most powerful security header — and the most misconfigured. It creates a whitelist of sources the browser is allowed to load resources from. A well-configured CSP stops cross-site scripting (XSS), data injection, and unauthorized code execution dead in their tracks.
Start restrictive and loosen only as needed. The example above is a strong baseline: only allow resources from your own domain, with images also permitting inline data URIs.
3. X-Frame-Options
X-Frame-Options: DENY
This header prevents your site from being embedded in an iframe on another domain — the classic clickjacking attack vector. DENY blocks all framing. SAMEORIGIN allows framing by your own domain only.
Note: CSP's frame-ancestors directive is the modern replacement and offers finer control. Use both for maximum compatibility with older browsers.
4. X-Content-Type-Options
X-Content-Type-Options: nosniff
This small but important header stops browsers from "sniffing" the content type of a response. MIME sniffing can trick a browser into executing a file as JavaScript when it was uploaded as an image — a classic attack vector on sites that accept user uploads.
There's only one valid value: nosniff. Set it and forget it.
5. Referrer-Policy
Referrer-Policy: strict-origin-when-cross-origin
Controls how much information the browser sends in the Referer header when a user clicks a link from your site to another. The value above is the modern default in most browsers: send the full URL for same-origin requests, but only the origin for cross-origin requests — and nothing when downgrading from HTTPS to HTTP.
6. Permissions-Policy
Permissions-Policy: camera=(), microphone=(), geolocation=()
Formerly called Feature-Policy, this header lets you disable browser features your site doesn't use. If you don't need the camera, microphone, or geolocation API, turn them off. It reduces your attack surface and improves privacy.
How to Check Your Headers
Open your browser's developer tools (F12), go to the Network tab, reload your page, click any request, and look at the Response Headers section. Or use an online security header checker for a detailed report with recommendations.
Our SAB Security Deep Review checks all security headers and gives you a prioritized action plan — including exact configuration snippets for your server or CDN.
Quick Wins
If you do nothing else, set these three headers today:
- HSTS — forces HTTPS everywhere
- X-Content-Type-Options: nosniff — blocks MIME confusion
- X-Frame-Options: DENY — prevents clickjacking
These three take 5 minutes to configure and close the most common and easily exploited gaps. For Nginx or Apache, add them to your server block or .htaccess file. For Cloudflare or Netlify, use the HTTP response header settings in your dashboard.
Beyond Headers
Security headers are one layer in a defense-in-depth strategy. They protect the transport and the browser context — but they don't replace secure coding, regular updates, input validation, or proper authentication. Combine them with HTTPS, a web application firewall (WAF), and regular security reviews for comprehensive protection.