Security headers: the five lines your website should be sending, and probably is not

When your browser loads a web page, the server sends the page and a short list of instructions along with it. Most of those instructions are about caching and content types. A handful of them are about security, and they are the cheapest security improvement a website can make: a few lines of configuration, no code changes, no new software.

Most small-business websites do not send any of them. When we score a site with our Website Score tool, the security section is where most sites lose the most points, and it is almost always these headers.

Here is what each one does, why it matters, and what happens without it.

HSTS: “only ever talk to me over HTTPS”

Strict-Transport-Security tells the browser to remember, for a year, that your site is HTTPS only. After the first visit, the browser will never even try the plain-HTTP version, which closes the window where someone on the same coffee-shop Wi-Fi can intercept a visitor before the redirect to HTTPS happens.

Without it, every visitor who types your domain without the “https” makes one unprotected request first. With it, they never do.

One warning from our own experience: a header that says max-age=0 is not “HSTS on.” It is an instruction to forget HSTS. We found exactly that on a site we look after, left behind by a hosting setting, and it graded as a pass in tools that only check whether the header exists. Ours now checks the number.

Content Security Policy: “here is who is allowed to run code on my page”

A Content Security Policy is a list of the places your page is allowed to load scripts, styles, images, and fonts from. If an attacker manages to inject a script into your page, through a compromised plugin, a bad advert, or a form that echoes input, the browser refuses to run it because it is not on the list.

This is the single most effective header and the hardest to get right, because it breaks anything you forgot to list. Your analytics, your bot check on the contact form, your web fonts. The way to do it is to write the list, load every page, watch the browser console for the things it blocked, and add the ones you actually meant to load. Then leave it on.

Three small ones that take thirty seconds

• X-Content-Type-Options: nosniff stops the browser from guessing that a file is a script when the server said it was something else. Old attack, still works on sites that do not send this.
• X-Frame-Options: DENY (or the frame-ancestors rule inside the Content Security Policy) stops other sites from loading your page inside an invisible frame and tricking visitors into clicking on it. If your site is not meant to be embedded anywhere, deny it.
• Referrer-Policy controls how much of your visitor’s URL gets sent along when they click a link to another site. strict-origin-when-cross-origin sends your domain and nothing else, which keeps things like search terms or account paths out of other people’s logs.

A fourth, Permissions-Policy, tells the browser your page will never ask for the camera, microphone, or location. It is not protecting you from much on a brochure site, but it costs nothing and it is one more thing an injected script cannot do.

How to check your site

Ten seconds: put your address into the Website Score. The security section lists each header and whether it is present. You can also open your browser’s developer tools, reload the page, and look at the response headers on the first request.

If you are on WordPress or a page builder, a hosting control panel or a small plugin can add these. If you are on a custom site, it is a few lines in the server or edge configuration. Either way it is an hour of work, once.

Why we bother saying this

Because we run a security company, and we hold our own site to the same standard we would hold yours to. Every page on this site sends all five headers. If you would like yours to, and you would rather not learn header syntax on a Saturday, the website audit covers it, along with everything else we would fix on a site we were about to put our name on.