Security headers explained: what each one does and how to add it

Security headers are short instructions your website sends with every page. They tell the browser to always use HTTPS, which sites may embed yours, where scripts may load from and more. They cost nothing, take minutes to add, and they are among the first things any security scan checks.

How to see your current headers

In a terminal:

curl -sI https://www.example.com

Or open your browser's developer tools, go to the Network tab, reload the page and click the first request to see its response headers. Our free scanner also checks them for you across up to 15 pages.

The headers that matter

Strict-Transport-Security

Tells browsers to use HTTPS for your site from now on, even if someone types http:// or follows an old link.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Only add includeSubDomains if every subdomain supports HTTPS. Leave out preload until you are sure, because removing a site from the browsers' preload list is slow.

Content-Security-Policy

Lists where scripts, styles, images and frames may load from. If an attacker manages to inject a script tag, the browser refuses to run it from an unlisted source. This is the most powerful header and the easiest one to get wrong, so start in report-only mode:

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://www.googletagmanager.com

Report-only mode breaks nothing. The browser logs what would have been blocked in the developer console. When the console is quiet across your important pages, switch the header name to Content-Security-Policy.

Protection against clickjacking

Stops other sites from loading yours in an invisible frame and tricking visitors into clicking. The modern way is part of the content security policy:

Content-Security-Policy: frame-ancestors 'self'

For older browsers, also send X-Frame-Options: SAMEORIGIN.

X-Content-Type-Options

Stops browsers from guessing a file's type, which can turn an uploaded file into a script.

X-Content-Type-Options: nosniff

Referrer-Policy

Controls how much of the current address is shared when a visitor follows a link to another site. Addresses can contain private details such as reset tokens or search terms.

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy

Switches off browser features your site does not use, such as the camera, microphone and location.

Permissions-Policy: camera=(), microphone=(), geolocation=()

You may still see X-XSS-Protection recommended in older guides. Modern browsers have removed the feature it controlled, so you can leave it out.

Adding them

Nginx, inside your server block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header X-Frame-Options "SAMEORIGIN" always;

Apache, in your configuration or .htaccess, with mod_headers enabled:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

Node.js with Express: the helmet package sets sensible defaults with one line, app.use(helmet()).

On hosting platforms such as Vercel, Netlify or Cloudflare, headers are set in the platform's configuration file or dashboard.

After you add them

Check the headers again with curl -sI, click through your site to make sure nothing broke, and keep an eye on the browser console while your content security policy is in report-only mode. Then run a scan again to confirm everything is in place.