Website security headers explained: the 6 headers that actually matter

Security headers are the highest ROI fix in web security: each one is a single line of configuration, costs nothing, and blocks an entire class of attack. Yet most sites ship with none of them — not because developers don't care, but because the header names are cryptic and nobody explains what each one actually blocks. This guide does. For every header: what attack it stops, the recommended value, and the misconfiguration that makes it useless.

The quick-reference table

1Strict-Transport-Security (HSTS) — force HTTPS forever

HSTS tells the browser: never talk to this site over plain HTTP again. Without it, an attacker on a coffee-shop network can intercept the first HTTP request and strip the redirect to HTTPS (SSL stripping). With it, the browser upgrades every request internally before anything leaves the machine.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

2Content-Security-Policy (CSP) — the XSS kill switch

CSP is the most powerful and most feared header. It whitelists where scripts, styles, images and frames may load from, so even if an attacker injects a <script> tag into your page, the browser refuses to execute it. It is the difference between an XSS bug being a nuisance and a full account takeover.

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'

3X-Frame-Options — stop clickjacking

Clickjacking puts your site in an invisible iframe on a malicious page, so users think they're clicking "Claim prize" but actually click your "Delete account" button. X-Frame-Options: SAMEORIGIN tells browsers that only your own pages may frame your site. Modern sites should also set frame-ancestors 'self' inside the CSP, which is the successor directive — but keep the old header for legacy browsers.

4X-Content-Type-Options — one word: nosniff

Browsers try to be helpful: if a file labeled "image" looks like JavaScript, some will execute it anyway. That "helpfulness" turns any file-upload feature into an XSS vector. X-Content-Type-Options: nosniff disables it. There is no valid reason to omit this header — it breaks nothing.

5Referrer-Policy — stop leaking your URLs

When a user clicks a link from your site to a third party, the browser sends the full source URL in the Referer header. If your URLs contain tokens, reset links or private IDs (/reset?token=abc123), you just handed them to a stranger. Referrer-Policy: strict-origin-when-cross-origin sends only your domain name to other sites, and nothing at all on downgrades to HTTP.

6Permissions-Policy — disable APIs you don't use

Does your marketing site need access to the visitor's camera, microphone and precise geolocation? No — and neither does any ad script or embedded widget on it. Permissions-Policy: camera=(), microphone=(), geolocation=() removes those capabilities from the page entirely, shrinking the surface any compromised third-party script can abuse.

Check your own headers in 10 seconds

You don't need a tool to see the truth — ask the server directly:

curl -sI https://yourdomain.com | grep -iE "strict-transport|content-security|x-frame|x-content|referrer-policy|permissions-policy"

No output at all? You have zero of the six — which is where most sites start. Run the same command against several pages, not just the homepage: it's common for the landing page to be hardened while the app behind /login or a CDN-cached route sends nothing.

The 5-minute fix checklist

• Add nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy and Permissions-Policy first — they can't break anything.
• Enable HSTS with a short max-age, confirm HTTPS works everywhere, then raise it to two years.
• Roll out CSP in Report-Only mode, fix violations, then enforce.
• Set headers at the reverse proxy (nginx, Cloudflare) so they apply to every route, not just app responses.
• Re-test after every deploy — framework and CDN updates silently drop headers.