Website Security Headers: The Complete Guide for 2026

What are HTTP security headers?

HTTP security headers are directives sent by your web server that tell browsers how to behave when handling your site's content. They're your first line of defense against common web attacks — and most websites are missing at least half of them.

The good news? Adding security headers is usually a quick server configuration change that takes minutes, not hours.

The 6 essential security headers

1. Strict-Transport-Security (HSTS)

HSTS tells browsers to always use HTTPS when connecting to your site. Without it, attackers can intercept the initial HTTP request before the redirect to HTTPS happens (a "man-in-the-middle" attack).

Impact: Critical. This header prevents SSL stripping attacks and ensures all communication is encrypted. Set max-age to at least one year (31536000 seconds).

2. Content-Security-Policy (CSP)

CSP is the most powerful security header. It controls which resources (scripts, styles, images) the browser is allowed to load, preventing XSS attacks by blocking injected malicious scripts.

Impact: Critical. CSP is your primary defense against cross-site scripting (XSS). Start with a restrictive policy and loosen as needed.

3. X-Content-Type-Options

This header prevents browsers from "sniffing" the MIME type of a response, which can be exploited to execute malicious files disguised as harmless content types.

Impact: High. It's a one-line addition with no downsides. There's no reason not to include it.

4. X-Frame-Options

Prevents your site from being embedded in an iframe on another domain, protecting against clickjacking attacks where users think they're clicking on your site but are actually interacting with a malicious overlay.

5. Referrer-Policy

Controls how much referrer information is sent when users click links on your site. Without it, sensitive URL parameters (like session tokens or internal paths) can leak to external sites.

6. Permissions-Policy

Controls which browser features and APIs your site can use (camera, microphone, geolocation, etc.). This prevents malicious scripts from accessing sensitive device capabilities.

How to add security headers

The implementation depends on your hosting platform:

• Nginx: Add headers in your server block using add_header
• Apache: Use .htaccess with Header set
• Vercel/Netlify: Configure in vercel.json or _headers file
• Cloudflare: Use Transform Rules or Workers
• WordPress: Plugins like "Headers Security Advanced"

Common mistakes to avoid

• Setting HSTS max-age too low: Use at least 1 year (31536000). Shorter periods offer less protection.
• Overly permissive CSP: Avoid unsafe-eval unless absolutely necessary. It defeats the purpose of CSP.
• Forgetting subdomains: HSTS should include includeSubDomains to protect all subdomains.
• Not testing after adding: Always verify headers are being sent correctly using browser DevTools or a tool like Foglift.

Bottom line

Security headers are one of the easiest wins in web security. Most can be added in under 10 minutes and they significantly reduce your attack surface. Start with HSTS and CSP (the two most impactful), then add the rest.

Not sure where you stand? Run a free Foglift scan to see which headers you're missing and get specific recommendations for your setup.