Website security headers: a 9-point checklist you can fix today

01Why headers matter

Security headers tell the visitor's browser to refuse risky behaviour: loading your page inside someone else's frame, guessing file types, sending your full address to other sites, or running scripts from unknown places. They cost nothing, add no weight to the page, and block whole classes of attacks.

021. HTTPS with a valid certificate

Everything starts here. The whole site should load over HTTPS with a certificate that is valid and not expired. Free certificates from Let's Encrypt or your CDN are enough.

032. HTTP redirects to HTTPS

If someone types the plain http:// address, the server should answer with a permanent redirect to the https:// version.

043. HSTS: remember to use HTTPS

The Strict-Transport-Security header tells the browser to use HTTPS for your domain for a long time, even if the visitor types http.

Strict-Transport-Security: max-age=31536000; includeSubDomains

054. Content Security Policy (CSP)

CSP lists where scripts, styles and images may load from. It is the strongest defence against cross-site scripting (XSS), and the hardest header to get right.

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'

065. Clickjacking protection

Stop other sites from embedding your pages in a hidden frame. The modern way is frame-ancestors in your CSP, and X-Frame-Options covers older browsers.

X-Frame-Options: DENY

076. X-Content-Type-Options

Tells the browser to trust the declared file type and not guess. One line, no downside.

X-Content-Type-Options: nosniff

087. Referrer-Policy

Controls how much of your page address is shared when a visitor clicks a link to another site.

Referrer-Policy: strict-origin-when-cross-origin

098. No technology leaks

Headers such as Server: nginx/1.18.0 or X-Powered-By: PHP/7.4 tell attackers exactly which versions to look up. Remove or hide them where your platform allows.

109. Safe cookies

Cookies that hold a login session should carry Secure (HTTPS only), HttpOnly (not readable by scripts) and SameSite (limits cross-site sending).

Set-Cookie: session=...; Secure; HttpOnly; SameSite=Lax

11Where to set them

On Cloudflare Workers static assets, put a plain _headers file next to your site files:

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: strict-origin-when-cross-origin

Other hosts have their own place for this: nginx add_header, Apache Header set, or your hosting panel.

12Test your website

Enter your address and confirm that you may check it. One normal request is sent, like any browser, and nothing is stored.