The Security Headers Every Website Needs in 2026

Updated August 2026 · about an 8-minute read

HTTP security headers are the cheapest security win on the web: a few lines of server config, set once, that tell every visitor's browser to enforce HTTPS, refuse to be framed, and block injected scripts. They cost nothing and yet most sites are missing the important ones — Content-Security-Policy is absent on about 82% of sites, Permissions-Policy on 78%, and even HSTS on 45%.

Here are the six headers worth having in 2026, what each actually protects against, and how to add them.

The six that matter

Strict-Transport-Security (HSTS) — the critical one

HSTS tells the browser to only ever connect to your domain over HTTPS, which shuts down protocol-downgrade and SSL-stripping attacks. Without it, a network attacker can quietly serve your site over plain HTTP.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Start small (max-age=86400, one day) while you confirm every subdomain works over HTTPS, then raise it to six months or more. A max-age under ~6 months is barely better than nothing.

Content-Security-Policy (CSP) — the highest-leverage one

CSP tells the browser exactly which sources may supply scripts, styles, images and frames. A good CSP stops most cross-site scripting (XSS) even when your app has a bug. It's also the fiddliest to get right, so roll it out in report-only mode first:

Content-Security-Policy-Report-Only: default-src 'self'

Watch what breaks, tighten, then switch to the enforcing Content-Security-Policy header.

X-Content-Type-Options

One value, no downside: nosniff stops browsers from second-guessing a response's declared type and treating, say, an image upload as executable script.

X-Content-Type-Options: nosniff

X-Frame-Options (clickjacking)

DENY (or SAMEORIGIN) stops other sites from loading yours inside an invisible frame to trick your users into clicking things. Modern equivalent: frame-ancestors in your CSP.

X-Frame-Options: DENY

Referrer-Policy

Controls how much of your URL leaks to other sites in the Referer header. strict-origin-when-cross-origin is a sensible default; no-referrer is the strictest.

Permissions-Policy

Locks down powerful browser features (camera, microphone, geolocation) so injected or embedded content can't quietly use them. Start by disabling what you don't use: Permissions-Policy: geolocation=(), camera=(), microphone=().

How to add them

Nginx — in your server block:

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache — with mod_headers enabled:

Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"

Set them once, then verify forever

The catch with headers isn't adding them — it's that a later deploy, a new reverse proxy, or a framework upgrade silently drops one, and nobody notices because nothing visibly breaks. Check your headers now with the tool below, and if a missing header would matter, have something re-verify them on every change rather than trusting they'll stay. Headers are one of the three things a full external security check covers.