What is Security headers?
Security headers are HTTP response headers that switch on browser protections, such as forcing HTTPS, restricting script sources, or stopping your pages being framed by other sites.
Why businesses care
They are low-cost, defence-in-depth controls that reduce the impact of common web attacks.
Example
X-Content-Type-Options: nosniff; Referrer-Policy: strict-origin-when-cross-originHow to check
Run the security headers checker or view response headers in browser developer tools.
How to fix
Add the headers in your hosting dashboard, CDN or web-server configuration.
Common mistakes
- Assuming one header is enough
- Copying a strict CSP without testing
- Setting headers on the app but not on a CDN edge that overrides them
Check it with Security Headers Checker
Check your site’s HTTP security headers (HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and get values to add.
Open Security Headers Checker