Security headers explained for site owners

Security headers are short instructions your server sends along with every page. They tell the browser how careful to be with your site.

The ones that matter most

• Strict-Transport-Security (HSTS) makes browsers always use HTTPS for your site, even if someone types http.
• Content-Security-Policy (CSP) limits where scripts and styles may load from, which blocks many injected scripts.
• X-Content-Type-Options stops browsers from guessing file types in risky ways.
• Referrer-Policy controls how much of your page address is shared when visitors click a link.

Where to add them

Most hosts and CDNs let you add response headers in their settings. On WordPress, a security plugin can do it. Start with HSTS and X-Content-Type-Options, because they rarely break anything. Test CSP carefully, since a strict policy can block your own analytics or chat widget.

Check what you have

The security section of the website checker lists which headers your site sends and which are missing.