HTTP Security Headers: How to Check and Add Them to Your Website

HTTP security headers are a handful of lines your web server sends with every page. They cost nothing, take minutes to add, and tell the visitor’s browser to shut down whole categories of attack — clickjacking, protocol downgrades, content-type tricks and many cross-site scripting attempts. Yet most small business websites send none of them.

This guide shows how to check which security headers your site already sends, explains the six that matter for almost every website, and gives copy-paste configuration for Apache, Nginx, Cloudflare and WordPress — plus how to roll out the two powerful ones without breaking anything.

What are HTTP security headers?

When a browser loads a page, the server answers with the page itself plus a set of response headers — small instructions about how to handle it. Security headers are the subset of those instructions that restrict what the browser will do: always use HTTPS, never render this page inside someone else’s frame, do not guess file types, do not send full URLs to other sites, and so on.

They do not fix vulnerabilities in your code, but they make many of them much harder to exploit, and they are among the first things an attacker — or an auditor — looks at, because they reveal how carefully a site is run.

How to check your security headers in one minute

Pick whichever is easiest:

• In your browser: open your site, press F12, go to the Network tab, reload, click the first request (your page) and read the Response Headers section.
• From a terminal: run curl -I https://yourcompany.com and look at the list of headers returned.
• With a free online scanner: several public header-checking sites grade your site from A to F and list what is missing.

Write down which of the six headers below are already present before changing anything.

The 6 security headers every website should set

1. Strict-Transport-Security (HSTS)

Tells the browser to use HTTPS for your domain every time, for a set period, even if someone types http:// or clicks an old link. This blocks downgrade attacks on public Wi-Fi.

Strict-Transport-Security: max-age=31536000

Only add it once your whole site works over HTTPS. Start with a short max-age such as 300 (five minutes), confirm nothing breaks, then raise it to a year. Add includeSubDomains only when you are sure every subdomain supports HTTPS.

2. Content-Security-Policy (CSP)

The most powerful header and the strongest defence against cross-site scripting. It lists which sources scripts, styles, images and frames may load from, so an injected script from an attacker’s server simply does not run.

Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.example; frame-ancestors 'self'; base-uri 'self'; object-src 'none'

A full CSP needs tailoring to every script, analytics tool and widget your site uses, which is why it breaks sites when copied blindly. A safe first step that blocks nothing legitimate is:

Content-Security-Policy: frame-ancestors 'self'; base-uri 'self'; object-src 'none'; upgrade-insecure-requests

Then build the full policy using Content-Security-Policy-Report-Only, which reports violations in the browser console without blocking anything, until the reports are clean.

3. X-Content-Type-Options

Stops the browser from “sniffing” a file and deciding to run it as a script when the server said it was something else.

X-Content-Type-Options: nosniff

There is only one value and it is almost always safe. Just make sure your server sends the correct content type for .js and .css files.

4. X-Frame-Options

Prevents other sites from loading your pages inside an invisible frame and tricking visitors into clicking buttons they cannot see — an attack called clickjacking.

X-Frame-Options: SAMEORIGIN

Modern browsers use CSP’s frame-ancestors directive for the same job; sending both covers older browsers too.

5. Referrer-Policy

Controls how much of your page address is passed to other sites when a visitor clicks a link. Without it, URLs containing order numbers, search terms or reset tokens can leak to third parties.

Referrer-Policy: strict-origin-when-cross-origin

6. Permissions-Policy

Switches off browser features your site never uses — camera, microphone, location — so that even a compromised third-party script cannot request them.

Permissions-Policy: camera=(), microphone=(), geolocation=()

“Headers are the rare security win that is free, fast, and testable in a browser in under a minute.”

NyorsoftExternal Security Review

Headers you can skip or remove

• X-XSS-Protection — the browser filter it controlled has been removed from modern browsers. Leave it out, or set it to 0.
• Server and X-Powered-By — not security headers but information leaks. Values like PHP/7.4.3 tell attackers exactly which outdated software to target. Hide the version where your host allows it.

How to add security headers to your website

Apache or shared hosting (.htaccess)

Most shared hosting runs Apache or LiteSpeed, which read a .htaccess file in your website’s root folder:

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set Content-Security-Policy "frame-ancestors 'self'; base-uri 'self'; object-src 'none'; upgrade-insecure-requests"
</IfModule>

Nginx

Add these lines inside the server { } block for your site, then reload Nginx:

add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "frame-ancestors 'self'; base-uri 'self'; object-src 'none'; upgrade-insecure-requests" always;

Cloudflare

If your site sits behind Cloudflare, you can set headers without touching the server: go to Rules → Transform Rules → Modify Response Header, create a rule for your hostname and add each header with “Set static”. HSTS has its own switch under SSL/TLS → Edge Certificates.

WordPress

On most WordPress hosting the .htaccess method above works. If you cannot edit server files, a reputable security or headers plugin can add them — but check the result with a scanner afterwards, because caching layers sometimes strip headers set by plugins.

Roll out HSTS and CSP safely

1. Add the four low-risk headers first: X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.
2. Add HSTS with max-age=300, browse the site and its subdomains, then raise it to a year.
3. Add the safe baseline CSP above.
4. Draft a full CSP in Content-Security-Policy-Report-Only mode, click through every page, contact form and checkout, and fix the violations reported in the browser console.
5. When the reports are clean, switch the full policy to enforcing mode and re-test.

Check your work — or have us check it

Re-run your scanner or curl -I after every change. Security headers are one part of what we review in a Public Website Security Check, together with TLS configuration, email authentication (SPF, DKIM and DMARC) and what your site exposes to the public internet. If you would like a ranked list of what to fix, see our pricing or contact us.

Sources and further reading

• OWASP Secure Headers Project – recommended security headers and values.
• OWASP HTTP Headers Cheat Sheet – practical guidance for each header.
• MDN: Content Security Policy (CSP) – how CSP works and how to build a policy.
• MDN: Strict-Transport-Security header – reference for HSTS.

Written byPavol Huňor · IT Analyst, Nyorsoft

Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team