HTTP Security Headers: The Complete 2026 Guide (HSTS, CSP & More)

HTTP security headers are the simplest, cheapest security win available to any website. They require zero code changes, take about five minutes to configure, and defend against XSS, clickjacking, MIME-sniffing attacks, and downgrade attacks. In 2026, if your site is missing these headers, you're leaving the door open to attackers who scan millions of sites daily looking for exactly this kind of oversight.

The 6 essential security headers

1. Strict-Transport-Security (HSTS)

HSTS tells browsers to only connect over HTTPS, forever (or until the max-age expires). It eliminates the one-request window where a user types "example.com" in the address bar and a man-in-the-middle could hijack the HTTP request before the server redirects to HTTPS.

Recommended value: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

To get on Chrome's HSTS preload list (so even first-time visitors are protected), submit your domain at hstspreload.org.

2. Content-Security-Policy (CSP)

CSP is the most powerful — and most complex — security header. It tells the browser which sources (scripts, styles, images, fonts, frames) are allowed to load. A well-crafted CSP eliminates most XSS attacks even when you have a vulnerability elsewhere in your code.

Starter value: Content-Security-Policy: default-src 'self'; script-src 'self' 'strict-dynamic'; object-src 'none'; base-uri 'self'

Building a real CSP requires care — if your site uses inline scripts, CDN-hosted libraries, or third-party analytics, you need to allowlist them. Use report-only mode first (Content-Security-Policy-Report-Only) to see what would break before enforcing.

3. X-Frame-Options

Prevents your page from being loaded inside an iframe on another site (clickjacking protection). Simple, highly effective.

Recommended value: X-Frame-Options: DENY

Or, if you need to allow embedding in your own domain only: X-Frame-Options: SAMEORIGIN.

4. X-Content-Type-Options

Stops browsers from "sniffing" the actual content type of a response and executing it as something unexpected (e.g., executing a JPEG as JavaScript).

Only valid value: X-Content-Type-Options: nosniff

5. Referrer-Policy

Controls how much information is sent in the Referer header when a user clicks a link from your site. Strict policies protect user privacy and prevent leaking internal URLs.

Recommended value: Referrer-Policy: strict-origin-when-cross-origin

6. Permissions-Policy

Restricts which browser APIs your site can use (camera, microphone, geolocation, payment, etc.). If a third-party script gets injected, it can't silently access the camera.

Restrictive starter: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

How to check your security headers

Run our free HTTP Headers Checker on your own site (or any competitor) to see exactly which headers are present and get a 0-100 security score. The tool highlights missing headers in red and shows you exactly what to add.

Configuration by platform

How to set security headers on common stacks:

• Nginx: add_header Strict-Transport-Security "max-age=63072000; includeSubDomains"; in your server block
• Apache: Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" in .htaccess or vhost
• Cloudflare: Use Transform Rules or Workers to inject headers at the edge
• Vercel/Netlify: Configure in vercel.json or _headers file respectively
• Express.js: Use the helmet middleware — it sets all six defaults with one line

Common mistakes

• Too-permissive CSP — 'unsafe-inline' and 'unsafe-eval' defeat the purpose. Use nonces or strict-dynamic instead.
• HSTS without HTTPS everywhere — if HTTPS doesn't serve reliably, HSTS locks users out. Use our SSL Checker first.
• HSTS preload on a domain you don't fully control — preload is hard to reverse. Test with a short max-age first.

Try it now: Run the HTTP Headers Checker on your site and get a free security grade.