How to add security headers to a site

Before you start

• Access to server config, .htaccess, or CDN headers

The steps

1. 1

   Step 1: Check what you have

   securityheaders.com scores your current headers and names what is missing.

2. 2

   Step 2: Add the easy ones first

   X-Content-Type-Options: nosniff and Referrer-Policy: strict-origin-when-cross-origin break nothing.

3. 3

   Step 3: Add HSTS

   Strict-Transport-Security with a short max-age first. Increase it once you are certain HTTPS is permanent.

4. 4

   Step 4: Add Permissions-Policy

   Deny camera, microphone and geolocation unless you use them.

5. 5

   Step 5: Draft a CSP in report-only mode

   Content-Security-Policy-Report-Only, so violations are logged without anything breaking.

6. 6

   Step 6: Watch the reports

   For a week of real traffic. Every third-party script, font and embed will show up.

7. 7

   Step 7: Tighten and enforce

   Move to Content-Security-Policy once the report is clean.

8. 8

   Step 8: Re-test

   And re-test after any change that adds a third-party script.

Why CSP is worth the effort

It is the only header that meaningfully limits damage from an injected script. The others are hardening; CSP is containment, and it is the one that turns a compromised dependency into a blocked request rather than a data breach.

The static-site advantage

A site with no third-party scripts can enforce a strict CSP in an afternoon. Every analytics tool, chat widget and embed added afterwards is another exception, which is a reason to keep the list short.

Where to set them on shared hosting

On cPanel hosting without server config access, headers go in a .htaccess file in your document root using Header always set directives. Some shared hosts disable mod_headers entirely, in which case you cannot set them at all and the only route is a CDN in front of the site or a different host. Check with a request to your own domain rather than assuming the directives took effect, because a silently ignored .htaccess line looks identical to a working one.

The background behind this

Technical SEO, in the order the problems actually block you covers the reasoning in about 4 minutes — free, ungated, written from client work.

Who wrote this

Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada, Ireland and Pakistan. These procedures are the ones I run on client work, written down rather than invented — including the ones where the honest answer is that the fix is not available on your current hosting.