All questions
Q & A Security · September 11, 2026

Which security headers should every site set?

Minimum viable stack: (1) Strict-Transport-Security with max-age=31536000, (2) X-Content-Type-Options: nosniff, (3) Referrer-Policy: strict-origin-when-cross-origin, (4) X-Frame-Options: DENY or CSP frame-ancestors ‘none’. Add Content-Security-Policy once you know your resource origins. Add Permissions-Policy denying unused features (camera, microphone, geolocation). This 5-header stack blocks 80% of the common browser-side attack classes.

Read the full guide
HTTP Security Headers Explained: HSTS, CSP, X-Frame-Options, and the Rest
HTTP security headers are the browser-enforced defence layer that runs before your application code. Deployed correctly, they eliminate whole classes of attacks — even when the underlying application has bugs. Deployed incorrectly, they silently break the site.
Related questions
Do I need HTTPS to use security headers? How do I test my security headers without breaking production? What does an open port mean for security? What is the difference between X-Frame-Options and CSP frame-ancestors? Will CSP break my site?