Home / Knowledge hub / Security headers
Knowledge hub
Security headers
Response headers that switch on browser protections against common web attacks.
What it means
Security headers are HTTP response headers that tell a browser how to treat your pages. They switch on protections the browser already has: force HTTPS, limit which scripts run, forbid framing, stop type guessing, and restrict what is shared with other sites.
They are cheap to add, often one line in a server or framework setting. They are a safety net around the code, not a substitute for it. A header cannot make a vulnerable page safe, but it can stop some flaws turning into incidents.
Why it matters
The right headers turn a script injection from full compromise into a blocked attempt, stop a page being framed for clickjacking, and keep sessions off plain HTTP. Customers, auditors and scanners look at them first, so missing ones are a visible, easily reported gap.
They also have a ceiling. A perfect score on a header grader means the cheap protections are in place and nothing more. A site can score well and still have broken access control. Treat them as hygiene that costs little, not as a measure of security.
How it shows up
The usual set: Strict-Transport-Security for HSTS, a Content-Security-Policy with a frame-ancestors rule, X-Content-Type-Options: nosniff, Referrer-Policy, and Permissions-Policy. See content security policy and referrer policy. The OWASP Secure Headers Project lists each of them with recommended values, and your framework may already set some by default, so read what it sends today.
The mistakes: headers set on the home page only, missing on API responses and error pages; a CSP so loose it allows anything; a header set by one layer and overwritten by another; and copied settings that break the site and are then switched off again by someone in a hurry. Check responses from every route type, including errors and redirects, and test again after each deployment, because settings drift when layers change.
Questions people ask
Security headers, answered
Which security headers matter most?
For most web apps: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, a frame restriction through CSP frame-ancestors or X-Frame-Options, Referrer-Policy and Permissions-Policy.
Start with those, then add others as your app needs them, such as cross-origin isolation headers for apps that embed sensitive content.
Do security headers fix vulnerabilities?
No. They reduce what an attacker can do with certain flaws, for example by blocking an injected script. The flaw stays in your code.
Fix the vulnerability, and keep the header as a second layer.
Are security headers part of a penetration test?
Usually they are checked, since they are quick to see. They are normally low-severity findings unless the missing header makes a real exploit possible.
A good report separates hygiene from findings that were proved exploitable.
Why do headers differ between pages?
Different layers set them: the web server, a framework, a CDN, an application route. Static files, redirects, error pages and API responses often miss the setting.
Test a sample of each kind of response, not only the home page.
How do we test our headers?
Fetch several pages and API routes with a browser tool or command-line client and read the response headers. Compare them to a reference such as the OWASP list.
Repeat after deployments, as settings drift.
Sources
Where this comes from
Related
Terms that sit next to this one
HSTS
A header telling browsers to use HTTPS only for your site, every time.
Content Security Policy
A header telling the browser which scripts a page may load.
X-Content-Type-Options
A header that stops browsers guessing a file's type and running it as a script.
Referrer-Policy
A header controlling how much of your page address is sent to other sites.
X-Frame-Options
A header that stops other sites from placing your page inside a frame.
What do your responses actually say?
We read the headers your running app returns on every kind of route and report which protections are missing or too loose, with the response that showed it. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.