Web development and performance
What is Security headers?
Security headers are HTTP response headers instructing the browser to enforce protections on your behalf: HSTS forces HTTPS, CSP restricts where resources may load from, X-Content-Type-Options prevents MIME sniffing, X-Frame-Options blocks framing, and Referrer-Policy controls what URL data leaks to other sites.
Also called: HTTP security headers · HSTS
The baseline set
| Header | What it does |
|---|---|
| Strict-Transport-Security | Forces HTTPS for a stated period, preventing downgrade |
| Content-Security-Policy | Restricts where resources may load from |
| X-Content-Type-Options: nosniff | Stops the browser guessing a file type |
| X-Frame-Options / frame-ancestors | Prevents your pages being framed |
| Referrer-Policy | Controls what URL data is sent to other sites |
| Permissions-Policy | Disables camera, microphone and geolocation by default |
Why they matter beyond security
They are a visible signal of competence to anyone technical evaluating a supplier, and they appear in most procurement questionnaires. Setting them costs one configuration block and is checked in seconds by anyone who cares.
The common gap
Headers set for one host and not the other. A site with a CDN configuration and a server configuration frequently has different headers depending on which serves the request, which is worse than having neither because it is invisible.
Where this is covered in depth
A definition can only go so far. Technical SEO, in the order the problems actually block you covers this properly — 4 minutes, free, no email required.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan. These definitions come from client work rather than from a content brief — where an entry describes a mistake, it is usually one found on a real site. More about how I work.