Website Security Headers Explained

Strict-Transport-Security (HSTS)

Forces browsers to use HTTPS for your site. Start with a short max-age and extend once nothing breaks.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Content-Security-Policy (CSP)

Controls where scripts, styles and other resources may load from. It is the most powerful and the easiest to get wrong. Begin with the report-only variant and review reports before enforcing.

Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' https:

X-Content-Type-Options

Stops browsers from guessing a file’s type, which blocks some content-sniffing attacks.

X-Content-Type-Options: nosniff

Referrer-Policy

Limits how much of your page address is shared with other sites when visitors click out.

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy

Disables browser features you do not use, such as the camera or microphone, for your pages.

Permissions-Policy: camera=(), microphone=(), geolocation=()

Clickjacking protection

Prevent other sites framing your pages with CSP frame-ancestors (preferred) or X-Frame-Options.

Content-Security-Policy: frame-ancestors 'self'

Where to add them

Add headers where your site is served: hosting dashboard, CDN rules (for example Cloudflare Transform Rules), or web-server config. If a CDN sits in front, check the headers visitors actually receive.