HTTP Security Headers: A Practical Checklist for Your Website

Why Headers Matter

Every web page is delivered with HTTP response headers. Some of them tell the browser to enable extra protections. They cost nothing to add and close several common attack paths. Check what your site sends today with our HTTP Headers tool.

The Checklist

1. Strict-Transport-Security (HSTS)

Strict-Transport-Security: max-age=31536000; includeSubDomains

Tells browsers to use HTTPS only for your domain for the given time, preventing downgrade to plain HTTP. Add includeSubDomains only if every subdomain supports HTTPS. Start with a short max-age if you are unsure, then increase it.

2. Content-Security-Policy (CSP)

Content-Security-Policy: default-src 'self'; img-src 'self' data:; frame-ancestors 'self'

Defines which sources the page may load scripts, styles, images and frames from. It is the strongest defense against cross-site scripting, but also the hardest header to get right: every analytics, advertising and font service you use must be allowed. Use Content-Security-Policy-Report-Only first to see what would be blocked.

3. X-Content-Type-Options

X-Content-Type-Options: nosniff

Stops browsers from guessing file types, which prevents some attacks with uploaded files. Safe to add everywhere.

4. Frame Protection

X-Frame-Options: SAMEORIGIN

Prevents other sites from embedding your pages in a frame, which protects against clickjacking. The modern equivalent is the CSP directive frame-ancestors; sending both is fine.

5. Referrer-Policy

Referrer-Policy: strict-origin-when-cross-origin

Limits how much of the current URL is sent to other sites when visitors click links. This is the default in modern browsers, but setting it explicitly documents your choice.

6. Permissions-Policy

Permissions-Policy: camera=(), microphone=(), geolocation=()

Disables powerful browser features your site does not use, including inside embedded content.

Headers to Remove or Avoid

• Server and X-Powered-By headers that reveal software names and versions give attackers free information. Remove or shorten them where your server allows it.
• X-XSS-Protection is obsolete. Modern browsers ignore it, and old implementations had their own problems. Rely on CSP instead.

Where to Set Them

Headers can be added in the web server configuration (IIS, Apache, Nginx), in the application, or at a CDN. Setting them in one place is easier to maintain than spreading them across layers.

Testing After Changes

1. Check the headers with HTTP Headers.
2. Open the site in a browser with developer tools and look for blocked resources in the console, especially after adding CSP.
3. Confirm the site still loads everywhere with Is My Site Down.