What Are Security Headers and Why Do They Matter

Security headers are HTTP response headers your server sends with every page. They instruct the browser to enforce protections that block whole categories of attacks — cross-site scripting (XSS), clickjacking, MIME sniffing, and protocol downgrade — before they can reach your users.

The six headers that matter most

• Content-Security-Policy (CSP): Controls which scripts, styles, and resources the browser is allowed to load. The single strongest defense against XSS.
• Strict-Transport-Security (HSTS): Forces browsers to use HTTPS for your domain, even if a user types http://. Set max-age=31536000 (one year) or longer.
• X-Frame-Options: SAMEORIGIN or DENY stops other sites from embedding yours in an invisible iframe (clickjacking).
• X-Content-Type-Options: nosniff stops the browser from guessing file types and executing disguised scripts.
• Referrer-Policy: Limits how much URL data leaks to other sites when users click links.
• Permissions-Policy: Disables browser features you don't use, such as camera, microphone, and geolocation.

How to add them

On Nginx, add to your server block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

On Cloudflare, use Rules → Transform Rules → Modify Response Header. On Vercel/Netlify, add them to vercel.json or a _headers file.

Verify it worked

Run a VitalSite scan, or check headers with curl -I https://yourdomain.com. Every missing header is a finding VitalSite flags with a stack-specific fix.