Six headers that harden any website.

Check your headers yourself

Run this in a terminal, replacing the address with yours, and look through the response headers it prints:

curl -sI https://example.com

Or open your site in Chrome or Firefox, press F12, choose Network, reload, click the first request and read its Response Headers.

The headers that matter

Strict-Transport-Security (HSTS)

Strict-Transport-Security: max-age=31536000; includeSubDomains

Tells browsers to use HTTPS for your domain for the next year, even if someone types http:// or follows an old link. Add includeSubDomains only when every subdomain works over HTTPS. Start with a short max-age such as 300 if you're unsure, then raise it.

Content-Security-Policy (CSP)

Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'

Lists where scripts, styles, images and other resources may load from, which stops most injected scripts from running. Sites that load third-party tools need those origins listed. Roll it out as Content-Security-Policy-Report-Only first so you can see what would break before enforcing it.

X-Frame-Options

X-Frame-Options: DENY

Stops other sites showing yours inside a frame to trick visitors into clicking things (clickjacking). The CSP frame-ancestors directive does the same job in modern browsers; sending both is fine.

X-Content-Type-Options

X-Content-Type-Options: nosniff

Stops browsers guessing file types, so an uploaded file can't be run as a script.

Referrer-Policy

Referrer-Policy: strict-origin-when-cross-origin

Keeps full page addresses, which can contain private details, from leaking to other sites.

Permissions-Policy

Permissions-Policy: camera=(), microphone=(), geolocation=()

Switches off browser features your site doesn't use, so injected code can't use them either.

One to remove: X-XSS-Protection is obsolete, and modern browsers ignore it.

Where to add them

• Cloudflare: Rules, then a response header Transform Rule that sets each header.
• Apache: Header always set lines in your site configuration or .htaccess.
• Nginx: add_header ... always; lines in the server block.
• WordPress and hosted builders: your host's settings, a security plugin, or a CDN in front of the site.

How Exposure checks them

Security headers come from your web server, so the instant check, which only reads public DNS, doesn't test them. Add your domain to a free Exposure account and verify you own it: Exposure then checks your sites for the HTTPS redirect, HSTS, CSP and frame protection, along with exposed .git and .env files, directory listings and public admin pages, and re-checks them every month.