Security HTTP headers-prevent attacks and protect browsers

Security HTTP headers tell browsers how to handle your site: block clickjacking, prevent MIME type sniffing, enforce HTTPS, and limit data collection. They're invisible to users but critical for protection.

Essential security headers

Strict-Transport-Security (HSTS)

Force HTTPS for all future visits (30 days):

Strict-Transport-Security: max-age=31536000; includeSubDomains

Content-Security-Policy (CSP)

Block inline scripts and only allow scripts from your domain:

Content-Security-Policy: default-src 'self'; script-src 'self'

X-Frame-Options

Prevent clickjacking by blocking iframe embedding:

X-Frame-Options: SAMEORIGIN

X-Content-Type-Options

Prevent MIME type sniffing attacks:

X-Content-Type-Options: nosniff

Referrer-Policy

Control referrer information:

Referrer-Policy: strict-origin-when-cross-origin

Add headers to your site

Via .htaccess (Apache)

<IfModule mod_headers.c>
  Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Content-Security-Policy "default-src 'self'"
</IfModule>

Via Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "SAMEORIGIN";

Test your headers

Check which headers your site sends:

curl -I https://yourdomain.com

Or use online tool: securityheaders.com

Related: SSL errors | TLS versions

Related articles