Most small business sites send none of them, because they are off by default and nobody notices until a scan flags them. This guide explains the six that matter, what each one protects against, a sensible starting value and how to check what your own site sends.
What a security header is
Every time your browser loads a page, the server replies with the page and with a set of headers, which are invisible lines of information about the page. Security headers are the ones that switch on protections in the browser. Because the browser does the enforcing, they work for every visitor without any change to your page content.
You can see yours with your browser's developer tools, in the network tab, by clicking the first request and reading the response headers. If you use a host such as a website builder, headers are often set in a settings screen or through a plugin, and you rarely need to edit code.
Strict Transport Security (HSTS)
HSTS tells the browser to use only the secure HTTPS version of your site for a set period, even if someone types the old http address. It protects against a visitor being silently sent to an insecure version of your site on a hostile network.
A typical value is Strict-Transport-Security: max-age=31536000, which remembers the rule for a year. Make sure your whole site, including subdomains you use, works on HTTPS before you turn it on, because a browser that has seen the header will refuse the insecure version. Our security check reports how many days your header makes browsers remember, because a very short setting gives little protection.
Content Security Policy (CSP)
CSP lists which sources of scripts, images and styles your page is allowed to load. If an attacker injects a script, or a compromised third party script tries to load something unexpected, the browser blocks it. It is the strongest header and also the hardest to set, because a policy that is too strict breaks pages.
Do not start with a strict policy. Many people begin with a report only mode, which logs what would have been blocked without blocking anything, then tighten it gradually. If you are not able to do this, ask your developer rather than copying a policy from the internet, since the wrong one can make your site stop working.
X-Frame-Options and frame ancestors
These control whether another website can display your page inside a frame. If it can, an attacker can place an invisible copy of your page under a fake button and trick people into clicking things, a technique called clickjacking. The simple fix is X-Frame-Options: DENY, or SAMEORIGIN if your own site frames its own pages. The newer way is the frame-ancestors rule inside a Content Security Policy.
X-Content-Type-Options, Referrer-Policy and Permissions-Policy
X-Content-Type-Options: nosniff stops a browser guessing a file's type and running something that was labelled as harmless. It has one safe value and no downside, so set it everywhere.
Referrer-Policy controls how much of the previous address is passed to the next site when someone clicks a link. A value such as strict-origin-when-cross-origin keeps the useful part for analytics while avoiding leaking full addresses. Permissions-Policy lets you switch off browser features you do not use, such as the camera, microphone and location, so that a compromised script cannot use them.
Check what your site sends, and what else is on the list
Open your browser's developer tools, load your home page and look at the response headers. A missing header is not an emergency, but a site sending none of them is easy to improve in an afternoon. Start with HSTS, X-Content-Type-Options, X-Frame-Options and Referrer-Policy, since those rarely break anything, and add CSP last.
The Security and SSL Check reads your headers and reports which of the six are present or missing, then checks the days left on your certificate, whether http redirects cleanly to https, whether your cookies are marked Secure, HttpOnly and SameSite, whether any version details leak and whether the page loads insecure items. Each failing check names the exact setting to change. It costs one credit. See also the SSL certificate checker guide and the Marketing Audit for the rest of the page.
Frequently asked questions
What are the most important security headers?
Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Start with the first one and the simple ones, then add a Content Security Policy.
Do security headers affect SEO?
They do not directly improve rankings. They protect visitors and your site, and HTTPS itself is a lightweight ranking signal. Their main value is preventing attacks and the loss of trust that follows.
Will adding headers break my site?
Most are safe. Content Security Policy is the exception, because a policy that is too strict blocks scripts or images the page needs. Test it in report only mode first.
How do I see which security headers my site sends?
Open your browser's developer tools, go to the network tab, reload the page, click the first request and read the response headers. A security check does the same for you and lists what is missing.
Where do I set security headers?
Usually in your web server or host settings, a hosting control panel, a content delivery network or a plugin. The place depends on how your site is built.