The six security headers worth setting (and what each one buys you)

Security headers are cheap wins: one line each, no application changes. Here is what to set, roughly in order of value.

1. Strict-Transport-Security (HSTS)

Tells browsers to only ever use HTTPS for your domain. Start with a short max-age (a day) and raise it once you are certain every subdomain supports HTTPS — the header is hard to undo quickly, and a wrong subdomain breaks for real users.

2. X-Content-Type-Options: nosniff

Stops browsers guessing a file's type, which closes a class of attacks where an uploaded file is treated as script. One word, no downside.

3. Content-Security-Policy

The strongest and the fiddliest. Start in report-only mode, watch what breaks, then enforce. Even a modest policy that only allows scripts from your own domain removes most injected-script risk.

4. X-Frame-Options or frame-ancestors

Prevents your pages being framed by someone else — the basis of clickjacking. SAMEORIGIN is the usual choice.

5. Referrer-Policy

Controls how much of your URLs leak to other sites when a user clicks a link. strict-origin-when-cross-origin is a sane default that keeps analytics working.

6. Permissions-Policy

Switches off browser features you do not use — camera, microphone, geolocation. Small win, zero cost.

Run a check: most sites find they have one or two of these, usually by accident. Three or four takes ten minutes and is where the real return is.

---

Ready to try it? Open the tool.