What are security headers, and does my site need them?
Worth a look
Security headers are short instructions your site sends to each visitor's browser, telling it to be careful in specific ways. They're extra seatbelts: your site works perfectly without them, and turning them on is usually a small configuration change rather than a project.
The six Gus looks for, in plain English
Always use the secure version (HSTS) — tells the browser to refuse the insecure http version of your site from now on, even if someone clicks an old link. This is the one most worth having, because it closes the gap that a redirect alone leaves open.
Content rules (CSP) — a list of where the page is allowed to load code and images from. It's the strongest of the six and the fiddliest to introduce, because a rule that's too strict breaks the page. Worth doing carefully rather than quickly.
No content-type guessing (X-Content-Type-Options) — stops the browser second-guessing what a file is, which is how an uploaded image occasionally gets treated as a script.
Clickjacking protection (X-Frame-Options) — stops other websites loading yours inside an invisible frame and tricking people into clicking things.
Referrer privacy (Referrer-Policy) — controls how much of your visitor's current address gets passed along when they click a link away from your site.
Browser feature limits (Permissions-Policy) — switches off access to things your site doesn't use, like the camera, microphone or location.
How much should you care?
Less than a scanner that grades you F would suggest. Missing headers are not a breach, not a vulnerability someone can exploit on their own, and not a reason to panic. Plenty of successful, perfectly safe websites are missing several.
What they are is evidence. A site with all six switched on is a site where somebody competent has been paying attention. A site with none is a site nobody has looked at since it launched — and that's usually true of more than just the headers.
Gus grades this gently for exactly that reason: he'll flag it when HSTS is missing or when four or more are absent, and otherwise mention it and move on.
The one caveat worth knowing
HSTS is a commitment. Once a browser has been told to use https only, it will refuse the insecure version for the length of time you specify — and you can't easily take that back. Turn it on after https redirects are working properly, not before, and start with a short duration.
How to check this yourself
- This one is genuinely hard to check without tools — the headers are invisible to a normal visitor.
- In Chrome or Firefox, press F12 to open developer tools, choose the Network tab, reload the page, click the first entry in the list, and look under “Response Headers”.
- Scan for the names above. Anything not listed there isn't switched on.
- Or run a free check-up and Gus will tell you which of the six are present, in words rather than header names.
What to ask your web person
Copy this. It's phrased so you don't have to know the jargon to ask for the right thing.
Could you add the standard security response headers to our site — Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy? I appreciate CSP needs care to avoid breaking the page, so I'm happy for that one to come last, or in report-only mode first.
Want to know if this applies to your site?
Gus checks this and everything else in the free check-up, then explains what he found in plain English. It's free, there's no account, and it takes about a minute.