HTTP Security Headers Explained
HTTP security headers are response headers a server sends that tell the browser to enforce extra protections beyond its defaults. They cost nothing to serve, but most sites still ship without several of the high-value ones.
Last updated: August 29, 2026
What does HSTS (Strict-Transport-Security) do?
Tells the browser to only ever connect to this site over HTTPS for a set duration, even if a user types http:// or clicks a plain-HTTP link. This closes the window where a first plaintext request could be intercepted and downgraded before the redirect to HTTPS happens.
What does CSP (Content-Security-Policy) protect against?
Restricts which sources of scripts, styles, images, and other resources the page is allowed to load, dramatically reducing the impact of an XSS vulnerability even if one exists. An injected script from a source not on the allowlist simply won't execute. It's also the header most likely to break something if written too strictly, since it needs to explicitly account for every legitimate script/style source the page actually uses (analytics, ad networks, fonts, etc.).
X-Frame-Options
Controls whether the page can be loaded inside a <frame>/<iframe> on another site. Set to SAMEORIGIN, it blocks clickjacking attacks where an attacker overlays your page inside their own to trick users into clicking something they can't actually see.
Referrer-Policy
Controls how much of the current page's URL gets sent as the Referer header when a user clicks a link to another site. strict-origin-when-cross-origin is a common, sensible default: it sends the full URL for same-site navigation but only the origin (no path/query) cross-site.
Permissions-Policy
Lets a page explicitly disable browser features it doesn't use (camera, microphone, geolocation, and more) so that even an unexpected third-party script embedded on the page can't invoke them.
X-Content-Type-Options
Set to nosniff, this stops the browser from trying to guess a resource's type based on its content rather than trusting the declared Content-Type header, closing off a class of attacks where a file is served as one type but executed as another.
Get an A-F score across HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy and Permissions-Policy for any URL.
Frequently asked questions
Which single header gives the most impact for the least effort?
HSTS. It's a one-line addition with essentially no risk of breaking existing functionality, and it closes a real downgrade window. CSP has the highest ceiling for impact but also the highest chance of breaking something if rushed.
Can adding these headers break my site?
CSP is the one to be careful with. An overly strict policy can silently block legitimate scripts, styles, or embedded content. The others (HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-Content-Type-Options) are generally safe to add without staged rollout, as long as X-Frame-Options doesn't conflict with a page you intentionally embed elsewhere.
Do I need all of these to get a good grade?
Getting most of them in place, even without a fully-tuned CSP, already puts a site well ahead of the average. Add CSP once you're able to test it thoroughly against everything the page actually loads.
What grade should I realistically be aiming for?
An A is the ceiling, but a solid B or low A without a perfectly-tuned CSP is a reasonable, safe target for most sites. It's better to ship the headers that carry no functional risk now than delay everything waiting to perfect CSP.