Security headers are HTTP response headers a website sends to browsers with each page, instructing them to enforce HTTPS, block framing, and restrict risky behavior. They help reduce common web attacks.
Security headers are short instructions your website sends to browsers along with every page. They tell the browser to always use HTTPS, refuse to load your site inside other websites, and limit risky behavior like loading unexpected scripts. Visitors never see them, but they close off whole categories of common attacks, and most take minutes to add.
When a browser loads one of your pages, your server sends some behind-the-scenes information with it, called headers. Security headers are the ones that tell the browser how careful to be with your site.
How do security headers work?
Your web server, host or CDN attaches each header to every response. The browser reads them and follows the rules. These are the six CyberVigil checks:
- Strict-Transport-Security (HSTS): always use HTTPS for this site.
- Content-Security-Policy (CSP): only load scripts and content from approved places. This limits the damage if malicious code slips into a page.
- X-Content-Type-Options: don't guess what a file is. Treat it as the type the server says.
- X-Frame-Options or CSP frame-ancestors: don't let other websites secretly embed your pages, a trick called clickjacking.
- Referrer-Policy: don't leak full page addresses to other sites when visitors click a link.
- Permissions-Policy: don't let the page use the camera, microphone or location unless you allow it.
Why do security headers matter for small businesses?
They're cheap protection. Each one switches off a known attack technique, and most need only a single line of configuration. Mozilla's web security guidance lists HSTS and clickjacking prevention as high-impact, low-difficulty changes.
They also help on platforms like WordPress, where plugins add scripts from many places. A sensible set of headers limits what a compromised plugin can do.
How do I check or set up security headers?
Run our free security headers checker to see which of the six you have.
Where you add them depends on your setup. Cloudflare can add headers with a Transform Rule. Many WordPress hosts offer a setting, or you can use a reputable headers plugin. Apache and Nginx servers take a few lines of config. Hosted builders like Squarespace, Wix and Shopify manage headers for you.
After adding them, click around your site. Check forms, embedded videos and checkout, then re-run the checker. Our WordPress security checklist covers headers alongside other quick wins.
A free CyberVigil scan checks all six headers along with your certificate, HTTPS redirect and email settings.
Common questions
Can adding security headers break my website?
Most can't. Content-Security-Policy is the exception, because a strict policy can block scripts, fonts or embedded videos your site relies on. Start with a light policy, test your forms, checkout and embeds, then tighten it over time.
Can I add security headers on Squarespace, Wix or Shopify?
Hosted website builders manage most headers for you and don't let you edit them directly. If one is missing, ask the platform's support, or put the site behind a service like Cloudflare if you're comfortable changing DNS.
Which security header should I add first?
Start with HSTS, X-Content-Type-Options and X-Frame-Options. They're quick to add and rarely cause problems. Leave Content-Security-Policy for last, since it takes the most testing to get right.
Sources
- Practical security implementation guides (MDN Web Docs)
- OWASP Secure Headers Project (OWASP Foundation)
- Strict-Transport-Security header (MDN Web Docs)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.