Security headers explained
A handful of response headers stop content sniffing, framing and referrer leaks. They take minutes to add and rarely break anything.
Step by step, with screenshots: X-Frame-Options, frame-ancestors and nosniff: stop clickjacking →
Check your own site
Runs this check and the other 192, free, in about 45 seconds.
Or run only this check with the free Security headers checker.
What it is
Security headers are HTTP response headers that tell the browser to switch on built-in protections for your site. The main ones are Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or CSP frame-ancestors, Referrer-Policy and Permissions-Policy.
They cost nothing at runtime and block whole classes of attack: content sniffing, clickjacking, protocol downgrades, referrer leaks and many cross-site scripting attempts. getReport checks each one and links to its own page; this page covers X-Content-Type-Options: nosniff, which stops browsers guessing a file's type and running an upload as a script. A site is in good shape when every HTML response carries the full set.
What a passing site looks like
- X-Content-Type-Options: nosniff is setwarning · −1.5 ptseffort S
X-Content-Type-Options header is missing
Why it matters. Without it, browsers may guess a file's type from its content and run an uploaded image or text file as a script.
- Send the header: X-Content-Type-Options: nosniff on every response.
Questions people ask
What does X-Content-Type-Options: nosniff do?
It tells the browser to trust the Content-Type the server declares and never guess a file's type from its contents. Without it, a browser may treat an uploaded text or image file as a script or stylesheet and run it. With nosniff, scripts and stylesheets served with the wrong type are blocked. nosniff is the only valid value, and it rarely breaks anything.
Which security headers should every website have?
The OWASP Secure Headers Project recommends Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, a framing rule through X-Frame-Options or CSP frame-ancestors, Referrer-Policy and Permissions-Policy. OWASP advises against the old X-XSS-Protection header, which modern browsers ignore: leave it out or set it to 0. Start with the headers that rarely break anything, and test CSP in report-only mode first.
What does the Referrer-Policy header do?
Referrer-Policy tells the browser how much of the current page's address to send in the Referer header when a visitor follows a link or the page loads a file from another site. strict-origin-when-cross-origin, the default in current browsers, sends only the domain to other sites and the full URL within your own. Setting it explicitly keeps paths with personal data, such as reset tokens or search terms, from leaking.
How do I add security headers in WordPress?
Set them at the server or CDN if you can, which covers every response, including files. On Apache and LiteSpeed hosting, Header always set lines in .htaccess do it, and many hosts and security plugins offer a headers panel. Start with nosniff, frame protection, HSTS and Referrer-Policy, which rarely break anything, and try Content-Security-Policy in report-only mode first.
How do I add security headers in Cloudflare?
Create a response header transform rule in the Cloudflare dashboard that sets each header for your hostname. Cloudflare also offers a managed transform that adds a basic set of security headers in one click, and HSTS has its own setting under SSL/TLS, Edge Certificates. Headers set this way apply to cached and uncached responses alike.