HTTP security headers: HSTS, CSP and the ones that matter

A handful of response headers tell browsers how to protect your visitors. Here is what HSTS, CSP and the rest do, and how to add them.

Why headers matter

HTTP security headers are instructions your server sends with every response, telling the browser to enforce protections it would otherwise leave off. They are cheap defence-in-depth: a few lines of configuration that close off whole classes of attack.

The headers that matter

Strict-Transport-Security (HSTS) forces browsers to use HTTPS for your domain, preventing downgrade and cookie-stealing attacks. Content-Security-Policy (CSP) whitelists where scripts, styles and other content may load from — the single strongest defence against cross-site scripting.

X-Content-Type-Options: nosniff stops the browser guessing content types. X-Frame-Options or CSP frame-ancestors block your pages from being framed, defeating clickjacking. Referrer-Policy controls how much URL information leaks to other sites, and Permissions-Policy switches off browser features like camera and geolocation you do not use.

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin

Adding them

Headers are set wherever your responses are generated: your web server (nginx add_header, Apache Header set), your application framework, or your CDN edge. On Cloudflare you can add them in a Workers script or a Response Header Transform Rule.

Start with the quick wins that cannot break anything — HSTS, nosniff, frame protection, Referrer-Policy — and confirm each with a scan.

Rolling out CSP safely

CSP is the highest-impact header and the easiest to get wrong: a strict policy can block legitimate scripts and styles. Deploy it first in Content-Security-Policy-Report-Only mode, watch what it would have blocked, refine the policy, then switch it to enforcing.

Frequently asked questions

Are security headers required?

They are not mandatory, but they are a low-effort, high-impact way to protect visitors and are widely expected in security reviews and audits.

Which header matters most?

Content-Security-Policy gives the most protection (against XSS) but takes the most care to deploy. HSTS is the highest-value quick win.

Does HSTS need the preload flag?

No. preload adds your domain to browsers' built-in HTTPS list for extra protection, but plain HSTS with a long max-age already protects returning visitors.

Can security headers break my site?

A strict Content-Security-Policy can block legitimate resources, which is why you test it in report-only mode first. The other headers listed here are safe to add directly.

HTTP security headers explained