What Are HTTP Security Headers and How to Configure Them

What Are HTTP Security Headers?

HTTP security headers are response headers your server sends with every request, telling the browser how to handle your content safely. They don't replace SSL — they add extra layers of protection against XSS, clickjacking, data injection and other attacks.

Google, Mozilla and OWASP all strongly recommend them. Sites without them receive low security scores from tools like the Security Headers Checker.

The 7 Essential Security Headers

1. Strict-Transport-Security (HSTS)

Tells the browser to use HTTPS only for your domain — even if the user types http://. Eliminates SSL stripping attacks.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

• max-age: seconds the browser remembers (31536000 = 1 year)
• includeSubDomains: also applies to all subdomains
• preload: registers for the HSTS preload list (don't add unless you're ready)

2. Content-Security-Policy (CSP)

The most powerful header — defines exactly where scripts, styles, images and fonts are allowed to load from. Largely prevents XSS attacks.

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; img-src *

Start with Content-Security-Policy-Report-Only to see violations without breaking anything before enforcing fully.

3. X-Frame-Options

Prevents your site from being loaded inside an <iframe> on another domain (clickjacking). Technically superseded by CSP's frame-ancestors but still needed for older browsers.

X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN

4. X-Content-Type-Options

Stops the browser from MIME type sniffing — the browser follows exactly the Content-Type you declare instead of guessing.

X-Content-Type-Options: nosniff

5. Referrer-Policy

Controls what URL is sent in the Referer header when a user clicks an external link. Protects URL parameters containing sensitive data.

Referrer-Policy: strict-origin-when-cross-origin

6. Permissions-Policy

Controls access to browser APIs (camera, microphone, geolocation, fullscreen). Replaces the old Feature-Policy.

Permissions-Policy: camera=(), microphone=(), geolocation=()

7. Cross-Origin Headers (COOP/COEP/CORP)

A trio of headers for tab isolation from other origins — required if you use SharedArrayBuffer or performance.measureUserAgentSpecificMemory().

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin

How to Add Headers to Your Server

Apache (.htaccess)

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

PHP (Laravel)

In middleware or bootstrap/app.php:

$response->headers->set('X-Frame-Options', 'SAMEORIGIN');
$response->headers->set('X-Content-Type-Options', 'nosniff');
$response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');

Security Score — What It Means