Question 1

What are HTTP security headers?

Accepted Answer

Security headers are instructions a web server sends with every response that tell the browser how to behave more safely – for example forcing HTTPS, blocking framing, or restricting which scripts can run. They are a free, high-impact layer of defence.

Question 2

Which security headers matter most?

Accepted Answer

Content-Security-Policy (stops XSS), Strict-Transport-Security (forces HTTPS), and X-Frame-Options (stops clickjacking) have the biggest impact. X-Content-Type-Options, Referrer-Policy and Permissions-Policy add further hardening.

Question 3

How do I add missing security headers?

Accepted Answer

You set them in your web server or CDN config – for example add_header in nginx, the Header directive in Apache, or response-header rules in Cloudflare. Each missing header in the result above includes a one-line fix.

Free Security Headers Checker