Website security headers explained

In our October audits, 30 of the 33 Grand Strand business sites we checked were missing at least one of these, and 24 were missing most of them. They don’t fix a hacked site, but they shut off whole categories of attacks against your visitors.

The six

1. Strict-Transport-Security (HSTS)Tells the browser to only ever load your site over HTTPS, even if someone types http:// or follows an old link. Stops a visitor on public Wi-Fi from being quietly downgraded to an insecure connection.
2. Content-Security-Policy (CSP)A list of where your page is allowed to load scripts, styles, images and frames from. If an attacker manages to inject a script, the browser refuses to run it. The most powerful header and the one that takes the most care to set up.
3. X-Frame-Options or frame-ancestorsStops other sites from loading your pages inside an invisible frame and tricking visitors into clicking things, a trick called clickjacking.
4. X-Content-Type-Options: nosniffTells the browser to trust the file type your server says, instead of guessing. Stops some uploaded files being run as scripts.
5. Referrer-PolicyControls how much of your page’s address is passed to other sites when a visitor clicks away. Keeps things like search terms or form details in URLs from leaking.
6. Permissions-PolicyTurns off browser features your site doesn’t use, like the camera, microphone or location, so an injected script can’t ask for them.

How to check and add them

Our free website check lists which headers your home page sends. How you add them depends on the host: a settings panel, a configuration file, or a service in front of the site such as Cloudflare. Start with the four simple ones, then build a Content-Security-Policy in report-only mode so you can see what it would block before turning it on.

Every site we build and host sends all six, and our monitor checks them every five minutes. You can see that live on our proof board.