Web security · · 7 min read
Security headers: five lines of configuration that make your website harder to attack
HSTS, Content-Security-Policy and three more – what they do, what they don't do and how to introduce them without breaking anything.
Värn
Editorial team
HTTP security headers are instructions your web server sends to the visitor's browser. They cost almost nothing to introduce, but they close several common avenues of attack. Here are five that every company website should have.
A safeguard, not a vulnerability
A missing header does not mean the website can be hacked. It means an extra layer of protection is missing if something else – for example a plugin in your CMS – were to fail.
1. Strict-Transport-Security (HSTS)
Tells the browser to always use HTTPS for your domain. Without HSTS, an attacker on the same network – for example public Wi-Fi – can try to downgrade the visitor to unencrypted HTTP.
Strict-Transport-Security: max-age=31536000; includeSubDomains
Feel free to start with a shorter max-age and raise it once you know everything works. Only add includeSubDomains if all subdomains have HTTPS.
2. Content-Security-Policy (CSP)
Limits which scripts, style sheets and other resources the page may load. It is the most effective protection against cross-site scripting (XSS) – but also the one that needs the most thought.
Content-Security-Policy: default-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'
Introduce CSP step by step: start with Content-Security-Policy-Report-Only to see what would be blocked, adjust the policy and then switch it on for real. Avoid 'unsafe-inline' for scripts – use a nonce or a hash instead.
3. X-Content-Type-Options
Stops the browser from guessing the file type, which could otherwise make an uploaded file be interpreted as a script.
X-Content-Type-Options: nosniff
4. Protection against framing
Prevents your page from being embedded in an invisible frame on another website to trick visitors into clicking (clickjacking). Use the CSP directive frame-ancestors or the older header:
X-Frame-Options: DENY
5. Referrer-Policy
Controls how much of the address is passed on when the visitor clicks a link to another website. Without a policy, addresses with sensitive parameters can leak.
Referrer-Policy: strict-origin-when-cross-origin
Bonus: hide version numbers
Headers such as Server: Apache/2.4.41 or X-Powered-By: PHP/7.4 say exactly which software you run. That is not a vulnerability in itself, but it makes it easier for an attacker to find known weaknesses. Turn off the version information in the web server's configuration.
Where do the headers go?
That depends on where the website runs: in the web server's configuration (nginx, Apache, IIS), in a CDN such as Cloudflare, with your web host or in the platform's settings. Many CMSs also have plugins for it.
How Värn helps
Värn checks all the headers above on every verified website, explains each shortcoming and gives concrete configuration examples. Once you have added a header, the finding closes automatically at the next scan – and if it later disappears, for example after an update, the finding is reopened.
