How to check your website’s security headers

What are security headers?

Security headers are instructions your web server sends to the browser along with each page. They tell the browser to use HTTPS, refuse to load your site inside other people’s pages, and limit which scripts can run. They’re quick to add and close off several common attacks.

Check yours in two minutes

• Open your website in Chrome, Edge or Firefox
• Press F12 to open developer tools and choose the Network tab
• Reload the page and click the first request (your page address)
• Look under Response Headers for the names below

The headers that matter most

• Strict-Transport-Security — forces HTTPS. A common value is max-age=31536000; includeSubDomains
• Content-Security-Policy — controls which scripts, styles and images can load. The strongest protection against cross-site scripting, but needs testing before you turn it on
• X-Content-Type-Options: nosniff — stops browsers guessing file types
• X-Frame-Options: DENY (or CSP frame-ancestors) — prevents your site being embedded to trick users into clicking (clickjacking)
• Referrer-Policy: strict-origin-when-cross-origin — limits what address information is shared with other sites
• Permissions-Policy — switches off browser features you don’t use, such as camera or microphone

How to add them

Where you set headers depends on your hosting: your hosting control panel, a CDN such as Cloudflare (Rules → Transform Rules → Modify Response Header), your web server configuration (Apache .htaccess or nginx), or your application framework. Add one at a time and check your site still works — Content-Security-Policy in particular can block legitimate scripts if it’s too strict.

Headers are only one layer

Good headers make some attacks harder, but they don’t fix weak access controls, injection flaws or vulnerable software. A penetration test checks the things headers can’t.