← All articles
Security Headers 2026-01-16 · 7 min read

HTTP Security Headers Explained: HSTS, CSP, X-Frame-Options and More

Security headers are instructions a server sends with every response telling the browser how to behave. They are free to deploy and block whole categories of attack.

The headers that matter

  • Strict-Transport-Security (HSTS) — forces HTTPS for a set period. Example: max-age=31536000; includeSubDomains; preload.
  • Content-Security-Policy (CSP) — controls which sources of scripts, styles and images are allowed, the single strongest defence against cross-site scripting (XSS).
  • X-Frame-Options — SAMEORIGIN stops your site being framed by attackers (clickjacking).
  • X-Content-Type-Options: nosniff — stops the browser guessing a file type and running a non-script as script.
  • Referrer-Policy — strict-origin-when-cross-origin limits how much URL data leaks to other sites.
  • Permissions-Policy — disables powerful features (camera, microphone, geolocation) you do not use.

Getting started

Start with HSTS and X-Content-Type-Options (both safe and instant), then add X-Frame-Options. CSP is the most powerful but needs testing — begin in report-only mode, watch what breaks, then enforce. A scan of your site headers shows which are present and which are missing.

Put this into practice
Run a free, private scan — no login, nothing stored.
🛡 Web Scan 🔒 SSL/TLS 📬 MX & Email 🎣 URL Check

Related articles

Security Headers Content-Security-Policy: Your Strongest Defence Against XSS CSP is the most effective header you can deploy — and the most misunderstood. Here is a practical path to a working policy.