Every time someone visits your website, your server sends back the page along with a set of instructions called HTTP headers. Visitors never see them, but their browser reads them. Some of these headers tell the browser how to protect the visitor while they use your site. These are known as security headers.
Security headers are not a cure-all, and a site without them is not automatically unsafe. But they are a low-cost way to switch on protections that modern browsers already support. Here is what the common ones do, in plain English.
Strict-Transport-Security (HSTS)
What it says to the browser: "Only ever connect to this site over HTTPS, and remember that for a set period."
Why it matters: Without HSTS, a visitor who types your address without https:// makes a first, unencrypted request before being redirected. HSTS tells the browser to skip that step on future visits, which closes a gap that could otherwise be used to intercept the connection.
Example: Strict-Transport-Security: max-age=31536000; includeSubDomains
Be careful with: includeSubDomains applies the rule to every subdomain, so make sure they all support HTTPS first. Adding your domain to the browser "preload" list is even more permanent and is hard to undo, so treat it as a deliberate decision rather than a default.
Content-Security-Policy (CSP)
What it says to the browser: "Only load scripts, styles, images and other content from these approved places."
Why it matters: CSP is one of the main defences against cross-site scripting, where an attacker manages to get their own code to run on your pages. If the code comes from a source you have not approved, the browser refuses to run it.
Be careful with: CSP is the most powerful header and the easiest to get wrong. A strict policy can break analytics, chat widgets, payment forms or embedded videos. Many sites start with Content-Security-Policy-Report-Only, which reports what would have been blocked without blocking anything, then tighten the policy over time.
X-Content-Type-Options
What it says to the browser: "Trust the file type I tell you. Don't guess."
Why it matters: Some browsers used to "sniff" files and decide for themselves what type they were. That behaviour could be abused to make a harmless-looking file run as a script. This header switches the guessing off.
Example: X-Content-Type-Options: nosniff
This is one of the simplest headers to add and rarely causes problems.
X-Frame-Options and frame-ancestors
What they say to the browser: "Don't let other websites display my pages inside a frame," or "only let these specific sites do so."
Why it matters: If another site can load your page invisibly inside its own, it can trick visitors into clicking buttons they cannot see. This is called clickjacking. X-Frame-Options: DENY or SAMEORIGIN prevents it. The modern equivalent is the frame-ancestors setting inside Content-Security-Policy, which offers more control. Many sites send both for compatibility.
Referrer-Policy
What it says to the browser: "When a visitor clicks a link to another site, here is how much of my page address you may pass on."
Why it matters: Page addresses can contain information you would not want shared, such as search terms or reference numbers. A policy such as strict-origin-when-cross-origin shares only your domain name with other sites, rather than the full address.
Permissions-Policy
What it says to the browser: "This site does not need the camera, microphone or location, so don't allow them."
Why it matters: If your site never uses a device feature, switching it off means a third-party script or embedded content on your page cannot use it either.
Example: Permissions-Policy: camera=(), microphone=(), geolocation=()
A header you can skip: X-XSS-Protection
You may see older guides recommend X-XSS-Protection. Modern browsers no longer use it, and MDN and OWASP both advise against relying on it. A good Content-Security-Policy does that job properly.
How to check your own site's headers
You can see the headers your site sends without any special tools. Only check sites you own or are authorised to check.
In your browser:
- Open your website.
- Open developer tools (F12 on most Windows browsers, or right-click and choose Inspect).
- Go to the Network tab and reload the page.
- Click the first item in the list (your page) and look at Response Headers.
From the command line:
curl -sI https://yourdomain.co.ukLook for each header named above. If one is missing, that is not a crisis, but it is worth a conversation with whoever manages your website.
Where headers are set
Headers are usually configured in one of three places: your web server settings, your hosting or website platform's control panel, or a content delivery network if you use one. Some website builders do not let you set all of them, so it is worth asking your provider what is possible.
Summary
Security headers are instructions that ask your visitors' browsers to apply extra protections. HSTS keeps connections on HTTPS, CSP limits where content can come from, X-Content-Type-Options stops file-type guessing, X-Frame-Options and frame-ancestors prevent clickjacking, Referrer-Policy limits what you share with other sites, and Permissions-Policy switches off features you do not use. Most can be added in minutes; CSP and HSTS deserve more care. Make changes on a test site first where possible.
Haj Tech's free one-off security check lists which security headers your site sends, explains each finding in plain English and gives step-by-step guidance on any gaps. Request one for a domain you are authorised to have checked at hajtech.uk.
Sources
- MDN Web Docs, Strict-Transport-Security
- MDN Web Docs, Content Security Policy (CSP)
- MDN Web Docs, CSP frame-ancestors
- MDN Web Docs, X-Content-Type-Options
- MDN Web Docs, Referrer-Policy
- MDN Web Docs, Permissions-Policy
- MDN Web Docs, X-XSS-Protection
- OWASP, HTTP Headers Cheat Sheet
- OWASP, Secure Headers Project
- HSTS Preload List
Want to know where your own website, email and domain stand? Request a free, no-obligation external security check for a domain you own or are authorised to have checked.
Request a free security check