Browsers now expect HTTPS, certificates expire sooner, and here is what to do. Here is a simple plan for your website this week.
Here is clear, current advice on security headers from MDN, OWASP, and other sources. Security headers are short rules your website sends to each visitor's browser. This week, check three things: your site runs only on HTTPS, your certificate renews on its own, and your site sends a small set of current headers.
What security headers do
When someone opens your site, your server sends the page. It also sends extra lines of information. MDN Web Docs explains that these lines are called headers. They let the browser and the server pass more details with each message.
Some headers are about safety. The OWASP Secure Headers Project says these headers can keep modern browsers from running into problems that are easy to prevent. Amabrik puts it simply. The headers are rules you hand to the browser. The browser enforces them for you.
Two attacks come up often:
- Cross-site scripting (XSS). A harmful script gets put into your page and runs there.
- Clickjacking. Another site hides your page in an invisible frame. A visitor then clicks your button without knowing it.
What changed this year
A few updates matter for small business websites.
- HTTPS warnings in Chrome. HTTPS locks the connection between the visitor and your site. Others cannot read or change it. Impinge Solutions reports that Google planned to start a warning in Chrome 154, in October 2026. It shows before the first visit to a public site that does not support HTTPS.
- Shorter certificates. A certificate is the digital file that makes HTTPS work. The same source says the longest a public certificate can last will drop from 398 days to 47 days. This happens in steps from March 2026 to March 2029. It also says one certificate provider has warned that renewing on a fixed 60-day schedule "will no longer be sufficient."
- New guidance on scripts. web.dev updated its security headers quick reference on October 26, 2026. It recommends a "strict" Content Security Policy. This uses a random code (called a nonce) or a fingerprint (called a hash) to approve each script.
- An old header to drop. The OWASP HTTP Headers Cheat Sheet says not to set X-XSS-Protection, or to turn it off. It warns that in some cases this header can create XSS problems on sites that were otherwise safe.
The headers to send now
The sources agree on most of the list. Here is what each header does.
- Strict-Transport-Security (HSTS). Tells browsers to use only HTTPS for your site. MDN notes that browsers ignore it if it is sent over plain HTTP.
- Content-Security-Policy (CSP). Limits which scripts and files a page may load. MDN's CSP guide says to send it on all responses, not just the main page.
- X-Content-Type-Options. Tells the browser to follow the file type you state, instead of guessing.
- Referrer-Policy. Controls how much address information is shared with other requests. OWASP says to set it on purpose. Do not rely on browser defaults.
- Permissions-Policy. Amabrik and Impinge Solutions both list it as one of six core headers.
- Frame protection. This blocks clickjacking.
The sources differ a little on frame protection. Amabrik lists the X-Frame-Options header. OWASP says the CSP frame-ancestors rule replaces X-Frame-Options in browsers that support it. OWASP suggests using frame-ancestors if possible.
Impinge Solutions reports that OWASP also recommends removing Expect-CT. This header is deprecated, meaning no longer in use. It also recommends removing or hiding headers like X-Powered-By. Those headers reveal what software runs your site.
Steps to take this week
- Type your web address with http:// in front. Check that it moves to https:// on its own.
- Ask your host or developer how your certificate renews. Impinge Solutions advises automatic renewal. It also advises an alert if a renewal does not happen.
- Ask your developer for a list of the headers your site sends today. Compare it to the list above.
- Add HSTS with care. MDN says the preload option needs a max-age of at least one year. It must also cover subdomains. Amabrik warns that getting removed from the preload list later takes months. Only use preload when every subdomain runs on HTTPS.
- Test changes before you enforce them. Impinge Solutions warns that some cross-origin headers can break maps, videos and booking widgets.
- Remove X-XSS-Protection, or set it to 0.
Headers add an extra layer of safety, not the whole job. web.dev and MDN both say you should still clean and check anything users type into your site.
How I can help
I can check these settings on your site and help you fix them. AppWT is based in Livonia, Michigan. AppWT has built 600+ websites, by its own count. The service is Website Security Services, starting price $497.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- HTTP headers - HTTP | MDN, MDN Web Docs
- OWASP Secure Headers Project | OWASP Foundation, OWASP Foundation
- Security Headers Explained: The 6 That Matter | Amabrik, amabrik.com, 2026-07-06
- HTTPS and security headers for business websites in 2026, impingesolutions.com, 2026-10-29
- Security headers quick reference | Articles | web.dev, web.dev, 2026-10-26
- HTTP Headers - OWASP Cheat Sheet Series, OWASP Foundation
- Strict-Transport-Security header - HTTP | MDN, MDN Web Docs
- Content Security Policy (CSP) - HTTP | MDN, MDN Web Docs
- Website Security Services at AppWT, AppWT
Tags
Frequently Asked Questions
What is a security header?
It is a short line your server sends with each page. It tells the visitor's browser to turn on certain protections. The browser enforces them.
Will Chrome warn visitors if my site has no HTTPS?
Impinge Solutions reports that Google planned to show a warning from Chrome 154, in October 2026. It appears before the first visit to a public site without HTTPS. Visitors would see a Continue to site button and a Return button.
Why do certificates need to renew automatically now?
The longest a public certificate can last is dropping from 398 days to 47 days, in steps from March 2026 to March 2029. One certificate provider says a fixed 60-day renewal will no longer be enough.
Should I still use X-XSS-Protection?
OWASP says not to set it, or to turn it off. It suggests relying on a Content Security Policy instead.
Should I use X-Frame-Options or frame-ancestors?
OWASP says the CSP frame-ancestors rule replaces X-Frame-Options in browsers that support it. It suggests using frame-ancestors if possible. Some guides still list X-Frame-Options among the core headers.
Enjoyed this article?
Share it with your network
