Security HTTP Headers Every Website Should Have

Security HTTP headers are small lines the server sends with every page, telling the browser how to behave to protect the user. They cost nothing, do not slow the site down, and defend against a whole range of common attacks. Yet a huge number of sites do not set them at all. Here is an overview of the ones that are essential today.

Seven headers worth setting

• Strict-Transport-Security (HSTS) — forces the browser to always use HTTPS and prevents SSL stripping.
• Content-Security-Policy (CSP) — defines which sources scripts and styles may come from; the main defence against XSS.
• X-Content-Type-Options: nosniff — stops the browser from guessing file types and executing something it should not.
• X-Frame-Options / frame-ancestors — prevents someone from embedding you in an iframe and running clickjacking.
• Referrer-Policy — controls how much source-page data leaks to other sites.
• Permissions-Policy — defines which features (camera, microphone, location) the page may use.
• Cross-Origin-Opener-Policy — isolates your window from potentially malicious other windows.

How to check what you have

Open a free header scanner (such as securityheaders.com) and enter your address. You get a grade from F to A+ and an exact list of what is missing. Most sites start at F or D simply because nobody added the headers — and an A is reachable in half an hour of work, without touching the application code.

Where they are configured

On an Apache server you add headers through .htaccess using Header set, on Nginx through add_header in the config. For WordPress there are a couple of plugins that do it through the interface. Tip: always roll CSP out gradually and in report-only mode, because it can break legitimate scripts if it is too strict.

If you would rather not touch the config, our SEO hosting plans come with a WAF and easy security-header setup, so your site scores better on scanners right away. See the plans and pricing and raise your protection level without the hassle.

Frequently asked questions

Do headers slow the site down? No — it is a few bytes per request, completely negligible.

Which should I set first if I am short on time? HSTS and X-Content-Type-Options are quick and harmless; leave CSP for last because it needs testing.

For details on the most important headers, see the guides on the Content-Security-Policy header and HSTS, and for headers to make sense, the site must first run on the modern TLS 1.3 protocol.