Security Headers Explained: HSTS, CSP, X-Frame-Options and More
Security headers are HTTP response headers that tell browsers how to treat your pages — and they block entire classes of attacks for zero cost. Here is what each one does and how to configure it.
Every response your web server sends can carry small instructions — HTTP response headers — that tell browsers how to treat your page. A handful of these, collectively called security headers, block entire classes of attacks: protocol downgrade, clickjacking, cross-site scripting, and MIME-sniffing exploits. They cost nothing, require no application code changes, and are one of the highest-return hardening steps available to any website.
HSTS (HTTP Strict Transport Security)
HSTS tells browsers to connect to your site over HTTPS only, for as long as the policy is valid. This defeats downgrade attacks and stops cookies from being sent over unencrypted Wi-Fi.
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Start with a short max-age to test, then raise it to one year. Once you are confident, submit your domain to the HSTS preload list so even first-time visitors are protected.
CSP (Content Security Policy)
Content Security Policy is the most powerful anti-XSS header. It restricts where scripts, styles, images, and frames may load from, so even if an attacker manages to inject markup, the browser refuses to execute the payload.
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'
Deploy CSP in Content-Security-Policy-Report-Only mode first and watch the reports. A policy that blocks your own legitimate scripts does more harm than good, so tighten it gradually.
X-Frame-Options / frame-ancestors
This header prevents clickjacking by forbidding other sites from embedding your pages in an iframe. X-Frame-Options: DENY blocks all framing; SAMEORIGIN allows framing only by your own pages. Modern browsers prefer the CSP frame-ancestors directive, which does the same job with more granularity — set both for full coverage.
X-Content-Type-Options
X-Content-Type-Options: nosniff stops browsers from guessing a file's type from its content. Without it, a user-uploaded text file that happens to contain script can be executed as JavaScript.
Two More Worth Adding
- Referrer-Policy: strict-origin-when-cross-origin — prevents your URLs, which often contain session tokens or user identifiers, from leaking to third-party sites.
- Permissions-Policy — disables browser features your site never uses, such as camera, microphone, or geolocation, reducing the damage a compromised third-party script can do.
Verify What You Ship
Headers only protect you if they actually reach the browser. Check them with curl -I https://yourdomain.com, then re-check after every infrastructure change — reverse proxies and CDNs frequently drop or mangle headers.
The 2MNY Security scanner checks all of these headers and more on every scan, flags missing or weak values, and tells you exactly what to change. Run a free scan to see how your headers score today.
1 What are HTTP security headers?
Security headers are small response headers your web server sends with every page that tell browsers to enforce protections — for example Strict-Transport-Security forces HTTPS, Content-Security-Policy restricts where scripts can load from, and X-Frame-Options blocks your site from being embedded in an attacker's iframe. They are a free, config-only layer of defense against XSS, clickjacking, and protocol downgrade attacks.
2 Which security headers are the most important?
The core set is HSTS, Content-Security-Policy, X-Frame-Options (or the CSP frame-ancestors directive), X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. A grading scan like the one at 2mny.com checks all of them plus cookie flags (Secure, HttpOnly, SameSite) and shows exactly which ones are missing on your site.
3 How do I check my website's security headers?
Run a free scan at 2mny.com/free-security-scan — the header audit lists every missing or misconfigured header with a severity grade and copy-paste fix examples for Apache, Nginx, and Laravel. You can also inspect headers manually in your browser's developer tools network tab, but you have to know what each one should look like.
4 Can a Content-Security-Policy break my website?
It can if you deploy it in enforcing mode without testing, because inline scripts, third-party widgets, or analytics loaders get blocked. The safe path is deploying a Report-Only policy first, watching the violation reports for a week or two, then switching to enforcement. Our scanner flags unsafe CSP patterns like unsafe-inline and missing default-src so you know where you stand.