How to Audit Your Website's HTTP Security Headers

HTTP security headers are one of the most commonly overlooked security improvements a website can make. They take minutes to configure but protect against entire categories of attacks including clickjacking, XSS, and protocol downgrade attacks.

Most websites are missing at least three or four important headers. This guide walks through how to check yours and what to do about the gaps.

Step 1: Check What Headers You Currently Have

Use the Security Headers tool on this site to fetch and analyze your site's response headers. Paste your URL, click Analyze, and you will see every header your server returns along with an explanation of what is missing.

You can also check from the command line:

curl -I https://yoursite.com

The Headers That Matter Most

Strict-Transport-Security (HSTS). Tells browsers to always use HTTPS for your domain, even if the user types the URL without the https:// prefix. Prevents protocol downgrade attacks where an attacker intercepts an HTTP connection before it can redirect to HTTPS.

Recommended value: max-age=63072000; includeSubDomains; preload

Content-Security-Policy (CSP). The most powerful header and the hardest to configure correctly. Tells the browser which sources of scripts, styles, images, and other resources to load. A strict CSP prevents most cross-site scripting attacks from executing even if your HTML is injected.

Start with report-only mode to see what would be blocked without actually breaking your site:

Content-Security-Policy-Report-Only: default-src 'self'

Use the CSP Analyzer tool on this site to parse and understand an existing CSP value.

X-Content-Type-Options. Prevents browsers from guessing the MIME type of a response and treating it as something else. Always set this to nosniff. Without it, an attacker who can upload a file to your server might be able to get browsers to execute it as JavaScript.

X-Frame-Options. Prevents your pages from being embedded in iframes on other sites. Clickjacking attacks embed a legitimate site in a transparent iframe on top of a malicious page and trick users into clicking buttons they cannot see.

Set to DENY (no iframes ever) or SAMEORIGIN (iframes only from your own domain).

Referrer-Policy. Controls how much information is included in the Referer header when users click links from your site. strict-origin-when-cross-origin is the recommended value: it sends the full URL for same-origin requests but only the domain for cross-origin ones.

Permissions-Policy. Restricts which browser APIs your site can use. If your site does not need the camera, microphone, or geolocation APIs, block them:

Permissions-Policy: camera=(), microphone=(), geolocation=()

Step 3: Adding Headers

On Nginx:

add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains; preload' always;
add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options DENY always;
add_header Referrer-Policy 'strict-origin-when-cross-origin' always;

On Apache:

Header always set Strict-Transport-Security 'max-age=63072000; includeSubDomains; preload'
Header always set X-Content-Type-Options nosniff
Header always set X-Frame-Options DENY

In Django:

SECURE_BROWSER_XSS_FILTER = True  # X-XSS-Protection
SECURE_CONTENT_TYPE_NOSNIFF = True  # X-Content-Type-Options
X_FRAME_OPTIONS = 'DENY'  # X-Frame-Options
SECURE_HSTS_SECONDS = 63072000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True

After Configuring: Verify

Run the Security Headers check again to confirm everything is set correctly. Headers that are configured in your application server may be stripped by a CDN or load balancer, so always verify from the actual response your users receive.