Why It Matters

HTTP security headers instruct web browsers how to handle site content securely. Implementing robust security headers hardens your website against common client-side exploits, clickjacking, and automated browser vulnerabilities.

  • Strict-Transport-Security: max-age=31536000; includeSubDomains - Forces perpetual HTTPS usage.

  • X-Frame-Options: SAMEORIGIN - Prevents external framing and clickjacking attacks (the newer CSP frame-ancestors directive does the same job).

  • X-Content-Type-Options: nosniff - Prevents browser MIME-type sniffing exploits.

  • Content-Security-Policy - Restricts authorized source domains for scripts and assets.

  • Referrer-Policy: strict-origin-when-cross-origin - Controls referrer information leakage across external domains.

Roll Out CSP Safely

A strict Content-Security-Policy can break analytics, chat widgets or payment forms. Start with Content-Security-Policy-Report-Only, review the reported violations for a week or two, adjust the allowed sources, then switch to the enforcing header.

How to Check It Worked

Open your site in a browser’s developer tools (Network tab, then the page request’s response headers), or run a free scan at securityheaders.com, to confirm each header is present on every page, not just the homepage.