HTTP security headers explained: HSTS, CSP, X-Frame-Options and more

WebsiteScanner · November 3, 2026 · about 8 min read

Every response from your web server carries headers the visitor never sees. A handful of them tell the browser to switch on protections it would otherwise leave off. They are free and usually take a few lines of configuration, but a careless value can also break logins, payment widgets or embedded videos. Here is what each one does and how to add it safely.

Strict-Transport-Security (HSTS)

Tells the browser to use HTTPS only for your domain for a period of time, even if someone types http:// or follows an old link. This blocks downgrade attacks on public Wi-Fi.

Strict-Transport-Security: max-age=31536000; includeSubDomains

What breaks: once a browser has seen HSTS, it refuses plain HTTP for that domain until max-age runs out — you can't undo it quickly. With includeSubDomains, any subdomain without a valid certificate (an old admin panel, a test site) becomes unreachable. Start with max-age=300, confirm every subdomain works over HTTPS, then raise it. Only add preload if you understand that removal from browser preload lists is slow.

Content-Security-Policy (CSP)

Lists where scripts, styles, images, frames and connections may load from. If an attacker injects a script tag, a strict CSP stops the browser running it. It's the most powerful header and the easiest to get wrong.

Start with Report-Only. This variant enforces nothing; the browser only reports (in the developer console, or to an endpoint you configure) what it would have blocked:

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://www.googletagmanager.com; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'

Browse your site — checkout, login, contact form, embedded maps and videos — and watch the console. Add each legitimate source, then rename the header to Content-Security-Policy to enforce it.

What breaks: analytics, chat widgets, payment forms, fonts or inline scripts silently stop working. 'unsafe-inline' for scripts weakens CSP a lot; nonces or hashes are better when your platform supports them.

X-Frame-Options and frame-ancestors

Stop other sites from loading your pages in an invisible frame and tricking users into clicking (clickjacking).

X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'

frame-ancestors is the modern replacement and can list specific partner domains; X-Frame-Options covers older browsers. What breaks: legitimate embedding, such as a booking widget shown on a partner site or a page builder's preview. Allow those origins in frame-ancestors.

X-Content-Type-Options

X-Content-Type-Options: nosniff

Stops the browser guessing a file's type, so an uploaded "image" can't be run as a script. What breaks: rarely anything; occasionally a script or stylesheet served with the wrong Content-Type stops loading, and the fix is to correct the type on the server.

Referrer-Policy

Referrer-Policy: strict-origin-when-cross-origin

Controls how much of the current URL is sent to other sites when a visitor clicks a link. This value sends only your domain to other sites and nothing when going from HTTPS to HTTP, so tokens or order IDs in URLs don't leak. Modern browsers already default to it; setting it explicitly makes the behaviour consistent. What breaks: stricter values such as no-referrer can hide referral data from analytics or affiliate partners.

Permissions-Policy

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(self)

Switches off browser features your site doesn't use, for your pages and any frames inside them. What breaks: a feature you do use, such as a store locator needing geolocation or an embedded payment form needing payment. List only what you are sure you don't need.

How to add them

nginx

Inside the server block for HTTPS. The always flag adds the headers to error responses too. Note that an add_header in a location block replaces, not extends, those defined higher up.

add_header Strict-Transport-Security "max-age=300; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy-Report-Only "default-src 'self'; frame-ancestors 'self'" always;

Test and reload with sudo nginx -t && sudo systemctl reload nginx.

Apache

Requires mod_headers (sudo a2enmod headers on Debian/Ubuntu). In the virtual host or .htaccess:

Header always set Strict-Transport-Security "max-age=300; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
Header always set Content-Security-Policy-Report-Only "default-src 'self'; frame-ancestors 'self'"

Cloudflare

If your site is proxied through Cloudflare, HSTS can be enabled under the SSL/TLS edge certificate settings. Other headers can be added with a Response Header Transform Rule (Rules → Transform Rules → modify response header, "set static"). Cloudflare's dashboard layout changes over time, so follow its current documentation. Headers set at Cloudflare apply even when your hosting doesn't let you edit server config.

The security headers generator builds these snippets for nginx, Apache or Cloudflare from the options you pick. After deploying, re-run the security headers check to confirm the headers arrive at the browser — a CDN, cache or plugin sometimes strips or duplicates them.

Monitor them

Headers disappear when a server is migrated or a config is overwritten. WebsiteScanner's free scan is passive: it reads your public responses, including headers, HTTPS, SPF and DMARC. After you verify ownership, it re-scans weekly for free and emails you when new issues appear. WebsiteScanner PRO adds a deep scan (5,000+ checks for known vulnerabilities), deep re-scans up to 10 times a day and uptime checks every 5 minutes.

Frequently asked questions