Security headers explained, with setup instructions for Apache, Nginx and WordPress
HSTS, Content-Security-Policy, X-Frame-Options and more, explained in plain English. With ready-to-copy configuration lines for the most common web servers.
With every page request, your server sends not only the page itself but also so-called HTTP headers. Some of them tell the browser how to behave in order to protect visitors. These security headers cost nothing, take a few lines of configuration and make many common attacks much harder.
Our security headers check shows how your website is doing, with a grade from A to F.
The six most important headers
Strict-Transport-Security (HSTS)
Tells the browser to access your website only over HTTPS for a certain period, even if someone types http:// or clicks an old link. This prevents an attacker on the same Wi-Fi from redirecting visitors to an unencrypted version.
Strict-Transport-Security: max-age=31536000; includeSubDomains
Important: only set HSTS once your website and all subdomains work reliably over HTTPS. The browser remembers the instruction for the specified time, here one year.
Content-Security-Policy (CSP)
Defines which sources scripts, images, fonts and other content may be loaded from. If an attacker manages to inject malicious code into your page (cross-site scripting), the browser blocks it because it does not come from an allowed source.
Content-Security-Policy: default-src 'self'; img-src 'self' data:; frame-ancestors 'none'
The CSP is the most effective header, but also the most work. If you embed external services such as Google Maps, YouTube or a booking widget, you must explicitly allow those sources. Tip: test first with Content-Security-Policy-Report-Only. The browser then only reports violations in the console but does not block anything.
X-Frame-Options
Prevents other websites from embedding your page in an invisible frame. With this trick, called clickjacking, visitors unknowingly click buttons on your page.
X-Frame-Options: DENY
The modern way is frame-ancestors 'none' in the CSP. Many sites set both to be safe.
X-Content-Type-Options
Stops the browser from guessing what kind of file it is receiving. Without this header, an uploaded text file could be interpreted as an executable script.
X-Content-Type-Options: nosniff
Referrer-Policy
Controls which address information is passed on when someone clicks an external link. Without a restriction, the full address including parameters can be transmitted, which may reveal personal data in search queries or form links.
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy
Defines which browser features your page and embedded content may use. If you don’t need the camera, microphone or location, block them.
Permissions-Policy: camera=(), microphone=(), geolocation=()
How to set up the headers
Apache (.htaccess)
On most hosting plans with Apache, you can add the headers to the .htaccess file in your website’s root directory:
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>
Nginx
In the configuration of the relevant server block:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
Then check with nginx -t and reload.
WordPress
If you have no access to the server configuration, security plugins that can set headers will help. Often you can also edit the .htaccess through your host’s file manager. Make a backup copy of the file first, as a single typo can take the whole website down.
Order for beginners
Start with the four easy headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. They practically never break anything. Next comes HSTS, as soon as HTTPS works everywhere. Save the Content-Security-Policy for last and test it thoroughly.
After every change, check the result with the security headers check.
Some hosting plans don’t allow custom headers. In that case it is worth thinking about switching.