Website security headers explained

Last reviewed: 8 November 2026

Security headers are short instructions your web server sends with every page. They tell the browser to block some common attacks. Run our free website security check to see which ones your site sends.

The headers that matter

Header	What it does	Safe starting value	Reference
Strict-Transport-Security	Makes browsers use HTTPS only	`max-age=31536000; includeSubDomains`	MDN
Content-Security-Policy	Limits where scripts and other content may load from	Start with `Content-Security-Policy-Report-Only`	MDN
X-Content-Type-Options	Stops browsers guessing file types	`nosniff`	MDN
CSP frame-ancestors (or X-Frame-Options)	Blocks clickjacking	`frame-ancestors 'self'`	MDN
Referrer-Policy	Limits URL details sent to other sites	`strict-origin-when-cross-origin`	MDN
Permissions-Policy	Turns off browser features you do not use	`camera=(), microphone=(), geolocation=()`	MDN

How to add them

cPanel or Plesk shared hosting (common with Malaysian hosts): add Header set lines to .htaccess on Apache, or use the panel's headers setting. Ask your host if you are unsure.
Cloudflare: use Transform Rules, or a _headers file on Cloudflare Pages (Cloudflare docs).
WordPress: a security plugin or your host can set them; test after each change.

Common mistakes

Turning on HSTS with includeSubDomains while a subdomain still has no HTTPS. That subdomain stops working in browsers.
Submitting to the HSTS preload list before you are sure. Removal is slow.
Enforcing a strict CSP straight away. Use report-only mode first.

Headers are one layer. A web application firewall and up-to-date software matter more.

FAQ

Which security header should I add first?

Strict-Transport-Security (once every page works on HTTPS) and X-Content-Type-Options: nosniff are the simplest wins.

Can security headers break my site?

Content-Security-Policy can, if it blocks scripts your site needs. Use report-only mode first. The other headers rarely cause problems.