Which security headers does your website need?

What are security headers?

Security headers are short instructions your server sends with each page. The browser reads them as rules and blocks risky behaviour. You can see them with a security headers check.

Which security headers matter most?

OWASP's HTTP headers cheat sheet lists a wider set of recommended response headers. These are the ones to look at first.

• Strict-Transport-Security (HSTS): keeps visitors on HTTPS.
• Content-Security-Policy (CSP): limits what a page may load.
• X-Content-Type-Options: stops the browser guessing file types.
• Referrer-Policy: controls what address info is passed on.
• Permissions-Policy: switches off browser features you do not use.

The OWASP cheat sheet also covers cross-origin isolation headers. Most small sites can leave those until the basics are in place.

What does HSTS do, and how do I set it?

MDN explains that Strict-Transport-Security tells browsers to use only HTTPS for your host, and to upgrade future HTTP attempts. It only affects later requests, and browsers ignore it if it arrives over plain HTTP.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

How do I add a Content Security Policy?

MDN says the CSP header lets you control which resources a page may load, which helps guard against cross-site scripting. OWASP describes CSP as complex to configure and maintain.

1. List where your scripts, images and styles really come from.
2. Write a policy with default-src as the fallback, then add script-src, img-src and style-src as needed.
3. Test it on a staging copy first.
4. Roll it out to the live site once nothing breaks.

How do I add the simpler headers?

OWASP recommends X-Content-Type-Options set to nosniff, so browsers follow the declared Content-Type. It also recommends an explicit Referrer-Policy and a Permissions-Policy that disables features such as camera and microphone.

X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), camera=(), microphone=()

OWASP also says to remove or neutralise the Server, X-Powered-By and X-AspNet-Version headers, because they reveal technology details. It says X-XSS-Protection should be unset or set to 0.

How do I check which headers my site sends?

ScanDefend covers HSTS, CSP and the other browser protections a website turns on.

You can see what a finding looks like in the sample report, or run your own through the website security check.

Key terms

• Security header: A rule your server sends with a page that tells the browser how to treat it.
• HSTS: A header that tells browsers to use only HTTPS for your site on future visits.
• CSP: A header that limits which sources a page may load scripts, images and styles from.

What to do

• Confirm your site loads over HTTPS before adding HSTS.
• Add Strict-Transport-Security with a short max-age first.
• Add X-Content-Type-Options: nosniff.
• Set a Referrer-Policy and a Permissions-Policy.
• Draft a Content-Security-Policy and test it on a staging copy.
• Remove Server, X-Powered-By and X-AspNet-Version headers.
• Recheck your headers after each change.

Frequently asked questions

Which security header should I add first?

Start with Strict-Transport-Security, once your site works fully over HTTPS. Then add X-Content-Type-Options, Referrer-Policy and Permissions-Policy, which are simple to set.

Can HSTS lock visitors out?

OWASP warns that a long duration with an expired or revoked certificate can lock legitimate users out until it ends. Keep certificate renewal working first.

Do I need a Content Security Policy?

OWASP says CSP is complex to maintain and matters mainly for pages that load and interpret scripts. Test it on a staging copy before going live.

How ScanDefend fits in

ScanDefend covers HSTS, CSP and the other browser protections a website turns on.

Want to see what a finished report looks like? View the sample report.

Check your site