Website Security Headers — What Each One Does and How to Check Them

Security headers take five minutes to add and have zero performance impact. Yet the majority of sites are missing at least half of them. This guide explains what each header does, what value to use, and what happens when it's absent — so you can make an informed decision about which ones matter for your specific site.

Why Security Headers Matter

Each header addresses a specific attack class. None of them are substitutes for good application security — a SQL injection vulnerability won't be stopped by a security header. But they're a layer of defence that costs nothing and closes real browser-level attack vectors.

From an SEO perspective: Google uses HTTPS as a ranking signal, and Chrome's "Not Secure" warnings (shown on HTTP pages) increase bounce rates. HSTS ensures your site always uses HTTPS even when linked over HTTP. The other headers protect your users from attacks that can compromise their session, credentials, or trust in your site — which indirectly affects engagement metrics that Google uses.

The Headers That Matter Most

Strict-Transport-Security (HSTS)

Strict-Transport-Security: max-age=31536000; includeSubDomains

Tells the browser: for the next year (31536000 seconds), only connect to this site over HTTPS, even if the URL says http://. Once a browser has received this header, it will automatically upgrade HTTP requests to HTTPS without ever making an HTTP connection — preventing SSL stripping attacks where an attacker downgrades your connection to unencrypted HTTP.

Requirements: Your site must be fully HTTPS before adding HSTS. If any page is only available over HTTP, HSTS will break access to it. Add includeSubDomains only if all subdomains also have valid HTTPS certificates.

Content-Security-Policy (CSP)

Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.cdn.com; img-src 'self' data:

The most powerful and most complex security header. CSP defines exactly which origins are allowed to provide scripts, styles, images, fonts, and other resources. A browser enforcing CSP will block any script or resource from an origin not listed in the policy — including injected malicious scripts in an XSS attack.

Writing a correct CSP for a real site is non-trivial because it needs to account for every CDN, analytics script, font service, and third-party embed you use. Start with a report-only policy (Content-Security-Policy-Report-Only) to audit violations without blocking anything, then tighten it.

X-Frame-Options

X-Frame-Options: DENY

Prevents your page from being loaded inside an <iframe>, <frame>, or <object> on any other site. Clickjacking attacks embed your login page inside an invisible iframe — the user thinks they're clicking a button on the attacker's site but are actually interacting with your login form.

Use DENY unless your own site legitimately embeds your pages in iframes — in that case use SAMEORIGIN to allow same-origin frames while blocking third-party embeds. This header is now superseded by CSP's frame-ancestors directive, but remains widely supported as a fallback.

X-Content-Type-Options

X-Content-Type-Options: nosniff

The simplest useful security header. Tells the browser to trust the Content-Type header and not try to "sniff" the actual content type. Without it, older browsers would guess that a file served as text/plain is actually JavaScript and execute it — a MIME sniffing attack. nosniff closes this entirely.

Referrer-Policy

Referrer-Policy: strict-origin-when-cross-origin

Controls how much referrer information is sent when the user clicks a link leaving your site. strict-origin-when-cross-origin sends the full URL for same-origin requests but only the origin (no path, no query string) for cross-origin requests. This prevents leaking sensitive URL parameters (like session tokens or private document IDs) to third-party sites via the Referer header.

Permissions-Policy

Permissions-Policy: camera=(), microphone=(), geolocation=(self)

Restricts which browser features your pages and their embedded iframes can access. An empty list (()) disables the feature entirely — no script on the page, including third-party embeds, can access the camera or microphone. If you don't use a feature, disabling it with Permissions-Policy prevents a compromised third-party embed from accessing it.

Headers Reference Summary

How to Check Your Security Headers

Use the Security Headers tool to check any URL's response headers instantly. It shows every security header present (or missing), the current value, and whether the value is correct — without requiring server access or browser dev tools.

Alternatively, open any page in Chrome, open DevTools (F12), go to Network → click any resource → Headers tab, and look in the Response Headers section for the security headers listed above.

Affiliate disclosure: Some links on this page may be affiliate links. We only mention tools we've personally used and have an honest opinion about. Affiliate revenue helps keep ByteWaveNetwork's tools free and maintained. We are not paid by any of the tools compared in this article for favorable coverage.