What Security Headers Does My Website Need

What a security header actually does

You ask a website for a page, and the server sends that page back. Along with the page, it sends a set of quiet instructions called response headers. Most are invisible to you. A handful of them tell the visitor's browser how to behave, what to trust, and what to refuse.

Security headers are those instructions. They do not change how your site looks, they do not slow it down, and your visitors never see them. They sit in the background and tell every browser to reject risky behavior. Set up right, they stop whole classes of attacks before anyone reaches your customers.

The better news is that you usually do not touch a single line of your code. Most of these headers live at your host or your CDN. You set them once, and they apply to every page you serve.

The headers that carry the most weight

Content-Security-Policy, or CSP, is the heavy hitter. It tells the browser exactly which sources are allowed to load scripts, styles, and images on your page. If an attacker manages to slip a malicious script in, a solid CSP simply refuses to run it. This is your strongest defense against cross-site scripting.

Strict-Transport-Security, known as HSTS, forces every connection to your site to use HTTPS. Without it, a visitor can be quietly downgraded to an unencrypted connection where someone on the same network can read or change the traffic. With HSTS in place, the browser refuses to connect any other way.

X-Frame-Options stops other sites from loading your pages inside a hidden frame, which is how clickjacking tricks people into clicking things they cannot see. X-Content-Type-Options, set to nosniff, stops the browser from guessing file types, which closes a sneaky path attackers use to run a disguised file as real code.

The headers that tighten the edges

Referrer-Policy controls how much address information your site shares when a visitor clicks through to somewhere else. A tight policy keeps private paths and query strings from leaking to third parties. Permissions-Policy lets you switch off browser features your site does not use, like the camera, the microphone, and location, so a compromised script cannot reach for them.

Two newer headers reduce the damage if something does slip through. Cross-Origin-Opener-Policy keeps windows your site opens from reaching back in and tampering with it. Cross-Origin-Resource-Policy controls which other sites are allowed to pull in your resources. Both are quiet, and both shrink the blast radius of an attack.

None of these protect you on their own. Together they form layers, and layers are what make an attacker's job slow, loud, and expensive. That is the whole goal here, to turn an easy target into one that is not worth the trouble.

Why this is worth an afternoon

These are some of the cheapest wins in all of security. You are not rebuilding anything and you are not hiring anyone. In most cases you add a few lines in your host or CDN settings, save, and every page on your site is covered. An afternoon of work can protect you for years.

Trust and rankings ride along too. Search engines and browsers reward sites that serve clean, secure responses, and real visitors notice when a site feels safe. Missing headers can surface as browser warnings that quietly cost you customers before they ever reach your contact page.

This is exactly what Canopy Guard checks for free. It scans every one of these headers, tells you in plain English which ones are missing, and maps each gap to MITRE ATT&CK so you can see the real technique it leaves open. Run your site, read the report, and fix what matters first.

Frequently asked questions