All questions
Q & A Security · September 11, 2026

Do I need HTTPS to use security headers?

HSTS explicitly requires HTTPS. CSP works over both HTTP and HTTPS but is much less useful over HTTP since an on-path attacker could strip it. Cookies with Secure attribute require HTTPS. In practice: security headers assume HTTPS, and any site not on HTTPS in 2026 has a bigger problem than missing security headers.

Read the full guide
HTTP Security Headers Explained: HSTS, CSP, X-Frame-Options, and the Rest
HTTP security headers are the browser-enforced defence layer that runs before your application code. Deployed correctly, they eliminate whole classes of attacks — even when the underlying application has bugs. Deployed incorrectly, they silently break the site.
Related questions
How do I test my security headers without breaking production? What does an open port mean for security? What is the difference between X-Frame-Options and CSP frame-ancestors? Which security headers should every site set? Will CSP break my site?