Security headers are instructions your website sends to browsers, such as "always use HTTPS" and "don't let other sites frame this page." If some are missing, add a starter set at your host, CDN or server config: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and a minimal Content-Security-Policy. On Squarespace, Wix and Shopify, the platform controls headers.
If your CyberVigil report says some security headers are missing, your site works fine for visitors. These are extra instructions for the browser, and adding them is a settings change rather than a rebuild.
Check your homepage below to see which of the six we look for are already in place.
What are security headers?
Every time a browser loads your page, your server sends a few lines of instructions along with it. Security headers are the ones that tell the browser how to protect your visitors: always use HTTPS, don't guess file types, and don't let other sites show your pages inside a frame.
Visitors never see them. If one is missing, the browser falls back to its default behavior, which is usually more permissive than it needs to be.
Which headers does CyberVigil check?
We read the headers on your homepage and check these six:
| Header | What it does | What passes in our scan |
|---|---|---|
| Strict-Transport-Security (HSTS) | Tells browsers to always use HTTPS for your site | max-age of at least six months |
| X-Content-Type-Options | Stops browsers guessing a file's type, which blocks some script tricks | nosniff |
X-Frame-Options or CSP frame-ancestors | Stops other sites loading your pages in a hidden frame (clickjacking) | DENY or SAMEORIGIN, or any frame-ancestors rule |
| Referrer-Policy | Limits how much of your page address is shared when visitors click away | Any value except unsafe-url |
| Permissions-Policy | Blocks browser access your site doesn't need, like the camera | Present |
| Content-Security-Policy | Limits where scripts, frames and other content can load from | Present |
Two to five passing headers shows as "Partially configured." Zero or one shows as "Needs attention."
What starter set should I add?
These values match the fix steps in your CyberVigil report. They're safe for most small business websites because none of them restrict which scripts, fonts or images your pages load.
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Content-Security-Policy: frame-ancestors 'self'; upgrade-insecure-requests
Two of them deserve a second look before you paste:
- HSTS can lock visitors out of any subdomain that doesn't have HTTPS, because of
includeSubDomains. If you're unsure about your subdomains, follow our guide to turning on HSTS in stages instead of using this line as is. - The Content-Security-Policy here only controls framing and upgrades old
http://links tohttps://. A full policy that lists every allowed script source protects more, but it takes testing, so leave that for later.
Check headers, certificates and email together
Run a free scan to see your security headers alongside HTTPS, certificate and email settings in one report.
- Free check
- No signup
- No changes to your website
Where do I add security headers?
Add them at whatever answers your visitors' requests. If you use Cloudflare in front of your host, add them in Cloudflare. Otherwise, add them in your server config or hosting settings.
Instructions for Cloudflare
- 1In the Cloudflare dashboard, open Rules and create a Response Header Transform Rule that applies to all incoming requests.
- 2Add a Set static header for each line in the starter set.
- 3Deploy the rule, then re-run the headers checker.
- 4For HSTS, use Cloudflare's own HSTS setting instead. Our Cloudflare security headers guide walks through both.
How do I check that nothing broke?
- Open your site in a private window and click through your main pages.
- Test anything that loads from another service: contact and booking forms, embedded maps and videos, chat widgets and checkout.
- If something stops loading, remove the Content-Security-Policy line first, since it's the most likely cause. Then re-add it once you've found the conflict.
- Re-run the security headers checker to confirm all six are live.
What should you do next?
- Add the starter set at your CDN or server, then re-run the headers checker.
- If HSTS was missing, roll it out in stages using our HSTS guide.
- Run the full free website security scan to see your email settings too.
Common questions
Can security headers break my website?
Most of them won't. Content-Security-Policy is the exception, because a strict policy blocks scripts, fonts or videos it doesn't list. The starter policy in this guide only controls framing and upgrades old http:// links, so it's unlikely to break anything. HSTS needs care too, which is why we have a separate guide for it.
Do I need all six headers?
Each one closes off a different problem, and together they're the set most security scanners look for. If you can only add some, start with HSTS, X-Content-Type-Options and X-Frame-Options. Our score treats two to five headers as a warning and zero or one as a fail.
I use Squarespace or Wix. How do I add headers?
You can't set most headers on these platforms, so a missing header there is a platform limit, not a mistake. Don't put the site behind Cloudflare's proxy to add them, because both platforms say they don't support that setup and it can break your certificate.
Does Content-Security-Policy-Report-Only count?
Not for our scan. MDN describes Report-Only as a way to test a policy by reporting violations without blocking anything. It's a good way to try a stricter policy, but keep a real Content-Security-Policy header in place alongside it.
Is X-Frame-Options still needed if I use frame-ancestors?
Not strictly. The CSP frame-ancestors directive replaces X-Frame-Options in modern browsers, and our scan accepts either one. Sending both does no harm and covers older browsers.
Sources
- OWASP Secure Headers Project (OWASP)
- HTTP Security Response Headers Cheat Sheet (OWASP Cheat Sheet Series)
- Content-Security-Policy (MDN Web Docs)
- Content-Security-Policy-Report-Only (MDN Web Docs)
- X-Frame-Options (MDN Web Docs)
- Permissions-Policy (MDN Web Docs)
- Apache Module mod_headers (Apache HTTP Server Documentation)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.