In this article
What Are HTTP Security Headers?
HTTP security headers are response headers that instruct browsers how to behave when handling your site's content. They form a critical layer of defense-in-depth, protecting against common web attacks like cross-site scripting (XSS), clickjacking, and protocol downgrade attacks by enforcing security policies at the browser level.
Security headers are part of the HTTP response sent by your server. They cost nothing to implement, require no code changes, and protect all visitors regardless of their browser version. Major security standards like OWASP recommend implementing these headers on every production website.
How HTTP Security Headers Work
Each security header controls a specific aspect of browser behavior, creating multiple layers of protection against different attack vectors.
- Content-Security-Policy (CSP) — defines trusted sources for scripts, styles, images, and other resources, preventing XSS by blocking unauthorized code execution
- Strict-Transport-Security (HSTS) — forces browsers to use HTTPS for all future requests to your domain, preventing protocol downgrade attacks and cookie hijacking
- X-Frame-Options and X-Content-Type-Options — prevent clickjacking by blocking your pages from being embedded in iframes, and stop MIME-type sniffing attacks
Try it free — no signup required
Generate Security Headers →When To Configure Security Headers
Security headers should be configured on every production website. They are especially important in these scenarios.
- Preventing XSS attacks — Content-Security-Policy is the most effective browser-level defense against cross-site scripting vulnerabilities
- HTTPS enforcement — HSTS with preload ensures users always connect via HTTPS, even on their first visit via the preload list
- Compliance requirements — standards like PCI DSS, SOC 2, and HIPAA require security headers as part of web application hardening
Frequently Asked Questions
What is CSP report-only mode?
Content-Security-Policy-Report-Only sends violation reports to a specified endpoint without actually blocking resources. This lets you test a new CSP policy in production without breaking your site. Once reports show no legitimate resources are blocked, switch to enforcement mode by using the Content-Security-Policy header instead.
How does HSTS preload work?
HSTS preload is a list maintained by browser vendors that hardcodes HTTPS-only access for listed domains. Once your domain is on the preload list, browsers will never make an HTTP request to it, even on the very first visit. To qualify, you must serve a valid HSTS header with max-age of at least one year, includeSubDomains, and the preload directive.
How can I test my security headers?
Use online tools like securityheaders.com or Mozilla Observatory to scan your site and receive a grade. These tools check all major security headers and provide specific recommendations for missing or misconfigured headers. You can also inspect headers directly in browser DevTools under the Network tab by examining response headers.