HTTP Security Headers That Matter

HTTP security headers are one-line instructions your server sends that switch on browser defenses: forced HTTPS, script allowlists, frame blocking, and referrer trimming. They cost nothing at runtime and deploy in minutes. This guide covers the headers that matter in 2026, what each defends against, and configs you can ship.

Which headers does a modern site actually need?#

Header	Defends against	Recommended value
Strict-Transport-Security	Protocol downgrade, cookie hijacking	max-age=31536000; includeSubDomains
Content-Security-Policy	XSS payload execution, injected frames	Nonce-based; see below
X-Content-Type-Options	MIME-sniffing confusion	nosniff
Referrer-Policy	URL/query leakage to third parties	strict-origin-when-cross-origin
Permissions-Policy	Silent sensor/API abuse	Deny what you don’t use, e.g. camera=()
X-Frame-Options	Clickjacking (legacy browsers)	DENY (superseded by frame-ancestors)
Cross-Origin-Opener-Policy	Cross-window attacks (XS-Leaks)	same-origin

Two entries you may still see in old checklists are gone for good reason: X-XSS-Protection controlled a browser auditor that no longer exists, and Expect-CT did its job and retired when Certificate Transparency became mandatory.

How do you deploy them without breaking things?#

The failure mode is not “too little security” — it is an over-tight policy shipped blind. Sequence the rollout:

1. Ship the harmless four first: X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and frame controls.
2. Add Strict-Transport-Security with a modest max-age=86400, confirm every subdomain serves HTTPS, then raise it to a year.
3. Run your Content-Security-Policy in Content-Security-Policy-Report-Only mode against real traffic until the report noise is zero — then enforce.

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'; base-uri 'none'" always;

Why is CSP the header worth the most effort?#

Because it is the only one that fights back after a bug ships. Correct output encoding should prevent cross-site scripting, but a strict CSP decides what an injected payload can actually do — and the modern nonce-based pattern is dramatically more robust than the old allowlist approach:

Content-Security-Policy: script-src 'nonce-r4nd0m123' 'strict-dynamic';
  object-src 'none'; base-uri 'none'; frame-ancestors 'none'

The nonce changes every response, so an attacker who can inject markup still cannot execute script without guessing it. 'strict-dynamic' lets your legitimately-loaded scripts load their own dependencies, which is what makes this deployable on real applications.

What do headers not fix?#

Headers harden the browser’s handling of your responses; they do not repair broken application logic. SQL injection sails straight past every header on this page, and a misconfigured CORS policy — covered in the same-origin policy explainer — is an application decision, not a header omission. Treat this layer as armor over correct code, and find the rest of the armor at the Web Security hub.