Security headers are one of the most effective and least implemented website security measures. They cost nothing, take minutes to configure, and prevent entire categories of attacks.
Essential Security Headers
X-Frame-Options: SAMEORIGIN
Prevents your website from being embedded in frames on other sites. This stops clickjacking attacks where hackers overlay invisible frames on malicious pages to trick users into clicking things on your site.
X-Content-Type-Options: nosniff
Prevents browsers from guessing file types. Without this, a browser might execute a malicious file disguised as an image. This header forces browsers to respect the declared content type.
Strict-Transport-Security (HSTS)
Forces browsers to always use HTTPS, even if someone tries to access HTTP. Prevents SSL stripping attacks and accidental unencrypted connections.
Content-Security-Policy (CSP)
Controls which resources the browser can load (scripts, styles, images, fonts). Prevents cross-site scripting (XSS) by only allowing resources from trusted sources. The most powerful but also most complex header to configure.
Referrer-Policy
Controls how much referrer information is sent when users click links from your site. Protects user privacy and prevents information leakage about your site structure.
The Headers AppWT Serves on Its Own Site
On October 3, 2026, appwt.com answered with Strict-Transport-Security for one year with preload, X-Frame-Options set to SAMEORIGIN, X-Content-Type-Options set to nosniff, a strict-origin-when-cross-origin Referrer-Policy, a Content-Security-Policy and a Permissions-Policy that turns the camera off.
You can read the same list for your own site in a browser's developer tools: open the network tab, select the first request and look under its response headers.
Implementation
For Apache (.htaccess), add Header set directives. For Nginx, add add_header directives. For Cloudflare, use Transform Rules. The exact syntax depends on your server configuration.
Test at securityheaders.com before and after to verify implementation.
Need security hardening? Contact us for a security audit and header implementation.
Tags
Frequently Asked Questions
What are security headers?
Security headers are instructions your web server sends to browsers telling them how to handle your content. They prevent clickjacking (embedding your site in a frame), cross-site scripting (injecting malicious scripts), and content type sniffing (tricking browsers about file types).
How do I add security headers?
Add headers through your web server configuration (.htaccess for Apache, nginx.conf for Nginx), through Cloudflare Transform Rules (no server access needed), or through WordPress security plugins like Wordfence or Headers Security Advanced.
How do I test my security headers?
Use securityheaders.com to scan your website. It grades your headers A through F and tells you exactly what is missing. Aim for an A grade. Most sites start at D or F before optimization.
Enjoyed this article?
Share it with your network
