Why security headers matter
HTTP response headers give browsers instructions about how to handle your content. Several security-focused headers have been standardized to protect users against common attacks including cross-site scripting, clickjacking and protocol downgrade attacks.
Most are simple one-line additions to your server or CDN configuration and have no negative performance impact.
Content-Security-Policy (CSP)
CSP defines which sources browsers are allowed to load scripts, styles, images and other resources from. A well-configured CSP is one of the most effective mitigations against cross-site scripting (XSS).
Content-Security-Policy:
default-src 'self';
script-src 'self' https://www.googletagmanager.com;
img-src 'self' data: https:;Strict-Transport-Security (HSTS)
HSTS tells browsers to always use HTTPS for your domain, even if a user types http://. The max-age directive should be at least one year (31536000 seconds) for production sites.
AI Website Auditor
Do you have all the right security headers?
Run a free audit to check:
X-Frame-Options
Prevents your page from being embedded in an iframe on another site, which protects against clickjacking attacks. Use DENY or SAMEORIGIN. For modern browsers, a CSP frame-ancestors directive provides more fine-grained control.
X-Content-Type-Options
Setting this header to nosniff prevents browsers from guessing the MIME type of a response. This prevents certain injection attacks that rely on MIME type confusion.
Referrer-Policy
Controls how much referrer information is included with requests. strict-origin-when-cross-origin is a sensible default that balances analytics utility with user privacy.
Permissions-Policy
Formerly Feature-Policy. Allows you to control which browser features and APIs are available to your page and any embedded content. Disabling features you don't use reduces the attack surface.
Quick Checklist
0/6 done