On this page
Definition
Security headers are instructions sent by a web server with a page response. They tell the visitor's browser how to handle security-related behaviour, such as whether scripts can run, whether the page may be embedded in another site, and whether the browser should only use HTTPS.
Security headers do not make a website immune to attacks, but they can reduce common risks when they are configured correctly and maintained as the website changes.
Key Takeaways
- Security headers are browser instructions that help reduce risks such as cross-site scripting, clickjacking, insecure connections and unnecessary data exposure.
- They work alongside HTTPS, secure coding, hosting controls, access management and ongoing maintenance. They are not a replacement for a properly secured website.
- Poorly planned headers can break forms, scripts, embeds, payment tools or third-party integrations, so they should be tested before being applied to a live website.
Quick Explanation
How Security Headers Protect Website Visitors
How It Works
What Happens When a Browser Receives Security Headers
Security headers are not visible on the page itself. They are sent in the HTTP response before the browser renders the page.
-
The visitor requests a page
A browser asks the website server for a page, image, script or another resource. This request usually happens over HTTPS for modern business websites.
-
The server responds with content and headers
The server returns the requested content and includes response headers. These headers may include security rules, caching instructions, content type information and other technical details.
-
The browser enforces the rules
The browser reads the headers and applies them while loading the page. Depending on the header, it may block unsafe scripts, prevent framing, force HTTPS or limit what browser features the page can access.
Common Security Header Terms
These terms often appear when security headers are reviewed. The exact configuration depends on the website, its platform and the third-party services it uses.
- Content Security Policy
- Content Security Policy, often called CSP, tells the browser which sources are trusted for scripts, styles, images, fonts, frames and other resources. It can reduce the impact of certain script injection attacks.
- HTTP Strict Transport Security
- HTTP Strict Transport Security, or HSTS, tells browsers to use HTTPS for future visits to the website. This helps prevent downgrade attempts where a browser might otherwise try an insecure HTTP connection.
- Clickjacking Protection
- Clickjacking protection is commonly handled through frame-related headers. These controls reduce the risk of your website being loaded inside another page in a way that tricks users into clicking something unintended.
Main Headers
Important Security Headers and What They Do
Example Response Headers
The following simplified example shows how security headers may appear in an HTTP response. This is not a universal configuration. A real policy should be tailored to the website, its scripts, forms, integrations and external services.
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.example;Security header examples should be tested before deployment, especially Content Security Policy rules.
Security Headers Compared With Other Website Security Controls
Security headers are one layer of protection. They work best when combined with secure development, managed hosting, HTTPS, access controls and ongoing monitoring.
| Security area | Security Headers | Other Security Controls |
|---|---|---|
| Main purpose | Guide browser behaviour, such as script loading, framing, HTTPS use and permission access. | Protect the server, application, accounts, data, network traffic and hosting environment. |
| Where they operate | Mostly in the visitor's browser after the server sends a response. | Across the website code, server, DNS, hosting stack, user accounts and third-party platforms. |
| Common limitation | Incorrect rules can break legitimate scripts, forms, embeds or integrations. | Other controls can still fail if software is outdated, credentials are compromised or third-party systems are misconfigured. |
Security Headers Are Not a Complete Security Strategy
Business Impact
Why Security Headers Matter for Business Websites
Benefits and Limitations of Security Headers
Benefits
- They help browsers block risky behaviour, such as untrusted scripts, insecure resource loading and unwanted framing.
- They can reduce unnecessary exposure of browser features and referrer information.
- They support a more disciplined security posture when combined with HTTPS, secure development and maintenance.
Limitations
- They cannot repair vulnerable application code, insecure plugins, weak credentials or poor server configuration.
- Strict policies can break legitimate website functionality if scripts, forms, embeds or third-party tools are not accounted for.
- They need review after website changes, platform migrations, new integrations or changes to external services.
Common Security Header Mistakes
Security headers are easy to copy, but not always easy to configure well. The right setup depends on how the website is built and what services it uses.
Copying a generic Content Security Policy from another website
Do this instead
Build the policy around the actual scripts, forms, analytics tools, payment systems and integrations used by your site. Test it in a staging environment before enforcing it.
Assuming HTTPS means security headers are unnecessary
Do this instead
Use HTTPS and security headers together. HTTPS encrypts traffic, while headers guide the browser on safer behaviour after the page loads.
Applying strict headers without checking third-party tools
Do this instead
Review contact forms, maps, booking widgets, payment gateways, videos, analytics and CRM scripts. These tools may need specific rules to keep working correctly.
Security Header Review Checklist
Use this checklist when reviewing security headers on a business website. It is a practical starting point, not a replacement for a full security audit.
-
Confirm HTTPS is working correctly before enabling strict transport rules
HSTS should not be applied casually to a site with incomplete HTTPS coverage, broken certificates or mixed content issues.
-
Test forms, scripts, embeds and integrations after adding headers
A header that improves security can still disrupt real website features if third-party sources are blocked by mistake.
-
Document what each header does and why it is used
Clear documentation makes future website updates, migrations and troubleshooting easier, especially when several providers are involved.
Problems That Can Be Linked to Security Headers
Not every website issue is caused by security headers, but they are worth checking when features stop working after a security change, migration or launch.
A contact form stops submitting
Likely cause
A Content Security Policy may be blocking a form endpoint, script, CAPTCHA service or CRM integration.
Solution
Check the browser console and response headers, then update the policy to allow required trusted sources without opening it more than necessary.
An embedded map, video or booking widget disappears
Likely cause
Frame or content rules may be blocking the external provider used to display the embed.
Solution
Identify the source domain required by the embed and update the relevant CSP or frame directive after testing.
A browser reports mixed content or insecure loading
Likely cause
Some resources may still be loading over HTTP, or HTTPS enforcement may have been applied before all resources were updated.
Solution
Fix insecure asset URLs, confirm SSL/TLS configuration and test the site before applying or tightening HSTS.
Our Approach
How We Approach Security Headers at Dobble
Security Headers FAQs
These answers cover common questions business owners ask when security headers appear in a website audit or technical review.
Do security headers improve SEO?
Can security headers break a website?
Are security headers needed if my site already has an SSL certificate?
Need Help Reviewing Your Website Security Setup?
If you are unsure whether your security headers are helping or causing issues, we can review your website, hosting and technical configuration. We will explain what needs attention and what should be tested before changes go live.