← All articles

HTTP Security Headers: A Practical Overview of the Essential Ones

17 September 2026

HTTP Security Headers: A Practical Overview of the Essential Ones

A handful of HTTP response headers instruct the browser to enable protections on your behalf — at almost no cost. Missing headers do not create a vulnerability by themselves, but they remove defences that would otherwise limit the impact of attacks like XSS and clickjacking. This article gives a practical overview of the essential ones.

The essentials

  • Strict-Transport-Security (HSTS): Forces the browser to always use HTTPS, closing the SSL-stripping gap. Start with a short max-age, then extend and add includeSubDomains/preload.
  • Content-Security-Policy (CSP): Restricts which sources the page may load and run scripts from. It is the strongest header for limiting the impact of XSS, and its frame-ancestors directive also prevents clickjacking. CSP needs tuning to your site to avoid breaking legitimate resources.
  • X-Frame-Options: DENY or SAMEORIGIN — anti-clickjacking for older clients; superseded by CSP frame-ancestors in modern browsers.
  • X-Content-Type-Options: nosniff: Stops the browser from “sniffing” and reinterpreting a response’s content type, mitigating some content-type confusion attacks.
  • Referrer-Policy: Controls how much referrer information is sent to other sites (privacy and leakage control).

A note on deprecated advice

Security guidance changes. For example, the X-XSS-Protection header is deprecated and can even introduce issues; modern defence relies on CSP and correct output encoding instead. Always prefer current sources over old blog posts.

How to apply and verify

  1. Add the headers at the web server or application layer (send them on all responses, including error pages).
  2. Roll out CSP gradually — consider report-only mode first — to avoid breaking legitimate scripts.
  3. Verify with curl -sI https://yoursite.com and review each header.

Summary

A small set of headers — HSTS, CSP (with frame-ancestors), X-Content-Type-Options: nosniff, and a sensible Referrer-Policy — provides strong, low-cost browser-side defences. They do not replace fixing the underlying flaws, but they meaningfully limit impact. Apply them carefully (especially CSP) and verify from real responses.

Sources: MDN: HTTP headers, OWASP Secure Headers Project.

CyberTestify’s external surface scan checks your security headers deterministically from real responses and flags what’s missing.