Glossary · Security

Security Headers

Security headers are HTTP response headers that instruct browsers to enable protections such as HTTPS enforcement, script restrictions and framing controls.

Updated October 6, 2026

Security headers are HTTP response headers a server sends to tell the browser which protective behaviours to apply to a page. They add defence in depth against attacks like cross-site scripting, clickjacking and downgrade to HTTP.

Why it matters

Browsers have many features that are safe to switch on but are not enabled by default for compatibility reasons. Headers are a cheap way to opt in, usually through server or CDN configuration without code changes. Commonly used ones include Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.

Example

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=()

Each line enables one browser-side protection for the page.

Common mistakes

  • Copying a strict Content Security Policy without testing, which breaks scripts and styles.
  • Setting headers on the main page but not on error pages or other hosts.
  • Assuming headers fix vulnerable code. They reduce impact, not root causes.
  • Letting a CDN or proxy overwrite or drop them.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityX-Content-Type-OptionsX-Content-Type-Options: nosniff is a response header that stops browsers from guessing a file's type and forces them to respect the declared MIME type.Guide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min readGuide · SSL & SecurityHSTS Preload Guide: Requirements, Risks and How to SubmitLearn what the HSTS preload list is, the exact requirements, the risks of includeSubDomains, how to submit your domain safely, and why removal takes months.7 min readGuide · SSL & SecurityHTTP Security Headers Guide: HSTS, CSP, Referrer-Policy and MoreA practical guide to HSTS, CSP, X-Content-Type-Options, frame-ancestors, Referrer-Policy and Permissions-Policy, with nginx, Apache and Express examples.8 min readGlossary · SecurityCookie Prefixes (__Host- and __Secure-)Cookie prefixes are name prefixes that make browsers enforce extra rules, such as Secure and no Domain attribute, on that cookie.Glossary · SecurityCORS (Cross-Origin Resource Sharing)CORS is a browser mechanism that uses HTTP headers to let a server permit specific other origins to read its responses, relaxing the same-origin policy.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.