What are HTTP security headers and which ones should my website have?
Short answer
Security headers are instructions a website sends to the browser to turn on protections. Most sites should set Strict-Transport-Security (HSTS), a Content-Security-Policy, X-Content-Type-Options: nosniff, a Referrer-Policy and frame protection through CSP frame-ancestors or X-Frame-Options.
The details
Headers are configured in your web server, CDN or framework settings. Test after each change, because a strict Content-Security-Policy can break scripts the site depends on. Roll out CSP in report-only mode first.
Useful next reads and tools
Terms explained
- Content Security Policy
- Content Security Policy (CSP) is an HTTP response header that tells the browser which sources a page may load scripts, styles, images and frames from.
- HTTPS and TLS
- HTTPS is HTTP protected by TLS encryption, which keeps data between a browser and a website private and tamper-resistant and confirms the site controls its domain.
Sources
Related questions
Related Guides
GuideWeb Security
How to Check Security Headers of a Website
Learn how to check security headers of a website using browser developer tools and terminal commands to defend against clickjacking, XSS, and MIME sniffing.
Read more GuideWeb Security
How to Prevent a DDoS Attack (Step-by-Step Guide for 2026)
Protect your website infrastructure from crashing. Learn the 6 best defensive measures to block malicious traffic, implement rate limiting, and stop DDoS attacks before they cost you revenue.
Read more