HTTP Security Headers: The Complete Checklist
HTTP security headers are small instructions your server sends with every page that tell the browser how to behave more safely. They are one of the cheapest, highest-impact security wins available — most take one line to add.
The short version
Add these first: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy. Together they defend against protocol downgrade, cross-site scripting, MIME sniffing, clickjacking and referrer leakage. You can check which ones your site already sends with our free headers check.
Why headers matter
When a browser loads your page, it trusts your server to tell it how the content should be handled. Attackers exploit the gaps in that trust: injecting scripts, framing your site to trick users, or downgrading a secure connection. Security headers close those gaps by making the browser enforce rules on your behalf — no application code changes required.
The essential headers
1. Strict-Transport-Security (HSTS)
Forces browsers to use HTTPS for your domain, even if a user types http://. This blocks a whole class of downgrade and man-in-the-middle attacks.
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadStart with a short max-age while you confirm every subdomain works over HTTPS, then increase it. Read the full HSTS guide before adding preload.
2. Content-Security-Policy (CSP)
The single strongest defence against cross-site scripting. CSP tells the browser which sources of scripts, styles and images are allowed, so injected code simply won’t run.
Content-Security-Policy: default-src 'self'; img-src 'self' data:; object-src 'none'CSP is powerful but easy to get wrong — start in report-only mode. Our CSP guide shows a safe rollout.
3. X-Content-Type-Options
Stops browsers from “sniffing” a file’s type and running it as something dangerous.
X-Content-Type-Options: nosniff4. X-Frame-Options
Prevents other sites from embedding yours in an invisible frame to trick users — a technique called clickjacking.
X-Frame-Options: SAMEORIGIN5. Referrer-Policy
Controls how much of your URL is shared when users click away to another site.
Referrer-Policy: strict-origin-when-cross-origin6. Permissions-Policy
Restricts access to powerful browser features like camera, microphone and geolocation.
Permissions-Policy: geolocation=(), camera=(), microphone=()Quick reference
| Header | Protects against | Priority |
|---|---|---|
| Strict-Transport-Security | HTTPS downgrade, MITM | High |
| Content-Security-Policy | Cross-site scripting (XSS) | High |
| X-Content-Type-Options | MIME sniffing | High |
| X-Frame-Options | Clickjacking | High |
| Referrer-Policy | Referrer data leakage | Medium |
| Permissions-Policy | Feature abuse | Medium |
How to add them
On Apache, add them to .htaccess with the Header set directive. On Nginx, use add_header inside your server block. On LiteSpeed, the Apache syntax works. Behind a CDN like Cloudflare, you can often set them at the edge. After deploying, re-run a scan to confirm they’re live.
max-age can break your own site. Roll out gradually and verify with a scan each step.Frequently asked questions
Do security headers slow down my site?
No. They add a few bytes to each response and have no measurable performance cost. Some, like enabling compression, actually make sites faster.
Will one header break another?
They’re independent, but CSP and X-Frame-Options overlap for framing control. If you set CSP frame-ancestors, it supersedes X-Frame-Options in modern browsers.
How do I know which headers I already have?
Run our free security headers check — it lists every protective header your site sends and flags what’s missing.
Related guides
HSTS Explained: Strict-Transport-Security Done Right
How HSTS forces HTTPS, what the preload list means, and how to roll it out without locking yourself out.
Read →HTTP Security HeadersContent Security Policy (CSP) for Beginners
How CSP stops cross-site scripting, why it is hard to get right, and a safe way to deploy your first policy.
Read →HTTP Security HeadersX-Frame-Options and Clickjacking Protection
How clickjacking attacks work and how X-Frame-Options and frame-ancestors stop your site being embedded maliciously.
Read →Check your site against this guide
Run a free ScanOpsPro scan and see how your site handles the fundamentals.
Run a free scan