HTTP security headers

Security headers check

Security headers are short instructions your website sends to the visitor's browser, such as "never show this site inside another site" or "only use HTTPS". They cost nothing and block whole classes of attacks.

Free. About one minute. Safe to run on a live website.

The headers that matter

Header	What it does	A safe starting value
Strict-Transport-Security	Forces HTTPS on every future visit.	`max-age=31536000; includeSubDomains`
Content-Security-Policy	Limits where scripts and other content may load from, which blocks most injected scripts (XSS).	Depends on your site. Start in report-only mode.
X-Frame-Options	Stops other sites showing yours in a hidden frame to trick clicks (clickjacking).	`SAMEORIGIN`
X-Content-Type-Options	Stops the browser guessing file types, which attackers can abuse.	`nosniff`
Referrer-Policy	Controls how much of your page address is shared with other sites.	`strict-origin-when-cross-origin`
Permissions-Policy	Turns off browser features you do not use, such as camera or microphone.	`camera=(), microphone=(), geolocation=()`

How to add them

Cloudflare (no code)

Rules → Transform Rules → Modify Response Header → Create rule, apply to all requests, and add each header with "Set static".

Nginx

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Apache / cPanel (.htaccess)

Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

WordPress

Ask your host to add them at server level, or use a well-maintained security headers plugin. Test the site after each change.

Content-Security-Policy needs care. A strict policy can break analytics, chat widgets or payment buttons. Roll it out with Content-Security-Policy-Report-Only first, fix what it reports, then switch it on.

Common questions

Will adding security headers break my website?

Most headers are safe to add straight away. Content-Security-Policy is the exception: test it in report-only mode first.

Do security headers affect SEO or speed?

No noticeable effect on speed. They are a few bytes per response. HTTPS itself is a small Google ranking signal.

Is X-XSS-Protection still needed?

No. Modern browsers ignore it. Content-Security-Policy is the current protection against injected scripts.

Check your website now

Enter your domain. You get a score, every problem in plain language, and an action plan that says who should fix what.