Intro
HTTP security headers let a site communicate browser-side rules about content, transport, framing, and information leakage. They are small configuration details with a large effect on the browser’s security boundary.
Headers are defence in depth, not a substitute for secure code, correct authentication, dependency updates, or server hardening.
The headers worth understanding first
- Content-Security-Policy (CSP) limits which scripts, styles, frames, and connections a page may use.
- Strict-Transport-Security (HSTS) tells browsers to use HTTPS for a defined period.
- X-Content-Type-Options: nosniff reduces content-type confusion.
- Referrer-Policy limits how much URL information leaves the site.
- Frame-ancestors in CSP or a carefully chosen frame policy helps reduce clickjacking risk.
Roll out CSP carefully
A strict CSP can break analytics, inline scripts, third-party widgets, or legitimate asset hosts if introduced without an inventory. Start with report-only testing where appropriate, remove unnecessary sources, and avoid weakening the policy simply to silence a violation.
Use a header scan as a checklist
The HTTP Security Headers Analyzer can show which common response headers are present and highlight obvious gaps. Confirm important changes with the real production response, redirects, subdomains, assets, and application flows.
Tip: A good score is not proof that an application is secure; it is a useful prompt for investigating browser-facing controls.
What each control can and cannot do
CSP is a browser policy, not a server-side input filter. A policy can restrict script sources, frame ancestors, image hosts, connections, and other resource types, but it cannot repair an XSS vulnerability in application code or make an unsafe third-party script trustworthy. Use nonces or hashes for tightly controlled inline code and review every allowed origin.
HSTS is also easy to misunderstand. It helps a browser remember that a host should use HTTPS, but it does not issue a certificate, encrypt an already-compromised endpoint, or protect first contact before the policy is known. Include subdomains or preload-related settings only after confirming that every affected host supports HTTPS.
Other useful controls have narrower jobs: X-Content-Type-Options: nosniff helps prevent MIME confusion, Referrer-Policy limits URL leakage, and Permissions-Policy can restrict selected browser features. A header is effective only when it is returned on the responses that matter, including redirects and error pages where appropriate.
A rollout workflow that avoids self-inflicted outages
- Inventory scripts, styles, frames, images, fonts, connections, workers, and third-party services.
- Add a report-only CSP or test policy in a staging environment.
- Exercise login, checkout, uploads, embedded content, error pages, and mobile flows.
- Review violations for genuinely required sources and remove accidental dependencies.
- Deploy with monitoring and a rollback plan, then test the real response with a header analyser and browser developer tools.
Headers should be reviewed alongside cookies, CORS, authentication, dependency security, and server configuration. A scanner can identify missing or surprising controls; it cannot prove that the application handles every threat correctly.
Practical takeaway
Security headers are most useful when they are treated as versioned application configuration. Inventory dependencies, test in report-only or staging modes, verify redirects and error responses, and monitor after release. Use the header analyser to find questions worth investigating—not to turn a score into a security claim.
FAQ
Do security headers protect an API?
Some headers mainly affect browser document behaviour, so their value depends on how the API is consumed. APIs still need authentication, authorization, input handling, TLS, and correct CORS policy.
Can I copy a header policy from another site?
Use other policies as examples only. Hosts, scripts, frames, CDNs, and application behaviour differ, so copying a policy can either break your site or leave important sources allowed.
Does HSTS replace HTTPS?
No. HSTS tells compatible browsers to insist on HTTPS after they have received the policy; the site still needs valid TLS and correct redirects.