Security headers
Security headers are HTTP response headers that instruct the browser to enforce protections such as transport security, framing rules and allowed script sources.
Updated 2 Sept 2026
In more detail
Because they are enforced by the browser, security headers act as a second line of defence: they limit what an injected script, a clickjacking frame or a downgraded connection can achieve even when an application flaw exists. The practical set is small — Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, and a framing rule via CSP's frame-ancestors — and each addresses a specific browser behaviour rather than a generic 'hardening' goal.
Why Security headers matters
Headers are the cheapest control available on most sites: they are configuration, not code, and they measurably reduce the impact of cross-site scripting, mixed content and UI redress attacks. They are also verifiable from outside the application, which makes them a reliable audit signal.
How it works
The server adds the headers to every response; the browser reads them before executing page content and refuses actions the policy disallows. Precedence matters — a meta-tag CSP cannot use every directive, and a header set at the CDN can silently override the application's own value.
Examples
- Strict-Transport-Security: max-age=31536000; includeSubDomains — forces HTTPS for a year.
- Content-Security-Policy: default-src 'self'; frame-ancestors 'none' — blocks unlisted script origins and framing.
- X-Content-Type-Options: nosniff — stops the browser guessing a response's MIME type.
How it is detected or measured
Inspect the response headers of a real page request (not just the homepage) with curl -I or the browser network panel, and confirm the same headers are present on API and error responses.
Where this matters
- Security Headers Explained
What each HTTP security header protects against, sensible starting values, and the order to deploy them without breaking your site.
- Website Security Checklist
A prioritised checklist covering access, patching, backups, monitoring and response — ordered by how much risk each control removes.
Related tools
Sources
- HTTP Security Response Headers Cheat Sheet — OWASP
Recommended header set and configuration guidance.