What Security headers means
Security headers block whole classes of attacks like clickjacking and some script injection at very low cost. They are set at the server, CDN or framework level. Free online tools can show which headers your site is missing.
Why it matters for your website
Headers add a layer of protection that works in every visitor's browser, helping block attacks like clickjacking and some script injection. They cost almost nothing to add, and missing headers are one of the first things security scanners and clients flag.
Example
A hypothetical online boutique adds a header that stops other sites from loading its checkout inside a hidden frame, which shuts down a common clickjacking trick.
Tips
- Run your site through a free header checker to see what is missing.
- Start a Content Security Policy in report-only mode before enforcing it.
- Test key pages and forms after each header change to catch breakage.
Common mistakes
- Copying a strict Content Security Policy that silently breaks forms, chat or analytics.
- Turning on HSTS before every subdomain reliably supports HTTPS.
Questions about Security headers
What is Security headers?
Server settings sent with each page that tell browsers how to protect visitors, such as HSTS and CSP.
Which security headers should every site have?
Common ones include Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, a frame control like X-Frame-Options or CSP frame-ancestors, and Referrer-Policy. The right settings depend on how your site works.
Do security headers affect SEO?
They are not a known direct ranking factor. They do support HTTPS and a safer site, which helps protect your visitors and your reputation.
