HTTP security headers are instructions your server sends to the browser about how to treat your site. They cost nothing, take minutes to add and block whole classes of attack. Here are seven worth adding.
1. Strict-Transport-Security (HSTS)
Forces browsers to use HTTPS. Only enable it once your whole site works over HTTPS.
Strict-Transport-Security: max-age=31536000; includeSubDomains
2. Content-Security-Policy (CSP)
Limits where scripts, styles and images may load from, which greatly reduces the damage of cross-site scripting. Start in report-only mode, because a strict policy can break pages if rushed.
Content-Security-Policy: default-src 'self'; img-src 'self' data:; script-src 'self'
3. X-Content-Type-Options
Stops browsers guessing file types, which blocks some upload-based attacks.
X-Content-Type-Options: nosniff
4. X-Frame-Options (or frame-ancestors)
Prevents other sites from embedding yours in a hidden frame (clickjacking).
X-Frame-Options: SAMEORIGIN
5. Referrer-Policy
Controls how much of your URL is leaked to other sites.
Referrer-Policy: strict-origin-when-cross-origin
6. Permissions-Policy
Turns off browser features you do not use, such as camera, microphone and geolocation.
Permissions-Policy: camera=(), microphone=(), geolocation=()
7. Secure cookie flags
Not a header name, but set on Set-Cookie: use Secure, HttpOnly and SameSite=Lax (or Strict) on session cookies.
How to add them
On Nginx use add_header; on Apache use Header always set in .htaccess; in Laravel add a small middleware. After deploying, re-test.
Test your site
Paste your address into our free Website Security Scanner and URL Vulnerability Scanner to see which headers are missing and what to fix first. Need help with a complex setup? Talk to us.