Skip to content
agentmarket

Security headers for small websites: the ones that matter

Blog · · 3 min read

HTTP security headers are instructions your server sends with every response telling the browser how to behave: only use HTTPS, do not let other sites frame you, do not guess file types. They cost nothing, take minutes to add, and close off whole classes of attacks. Most sites built quickly, by hand or with AI tools, ship none of them.

These are the ones worth adding on a small site, ordered from easy and safe to powerful but careful.

1. Strict-Transport-Security (HSTS)

Strict-Transport-Security: max-age=31536000

Tells browsers to use HTTPS for your domain for the next year, even if someone types http:// or follows an old link. It stops downgrade attacks on public Wi-Fi.

Be careful with `includeSubDomains`. It applies the rule to every subdomain, including any that still serve plain HTTP. Add it only when you are sure every subdomain has a certificate. Add preload only if you understand that removal from browser preload lists takes months.

2. X-Content-Type-Options

X-Content-Type-Options: nosniff

Stops browsers from "sniffing" a file and treating it as a different type than you declared, for example running an uploaded text file as a script. There is no downside. Add it everywhere.

3. Frame protection

X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'

Stops other sites from loading your pages in an invisible iframe and tricking users into clicking things (clickjacking). frame-ancestors is the modern version. X-Frame-Options covers older browsers. Use SAMEORIGIN or 'self' if you frame your own pages.

4. Referrer-Policy

Referrer-Policy: strict-origin-when-cross-origin

Controls how much of your URL is sent to other sites when users click away. With this value, other sites see only your domain, not full paths that might contain tokens or search terms. It is the default in modern browsers, but setting it explicitly is cheap.

5. Permissions-Policy

Permissions-Policy: camera=(), microphone=(), geolocation=()

Turns off powerful browser features your site never uses, so injected scripts or embedded third parties cannot request them.

6. Content-Security-Policy (CSP)

CSP is the most powerful header and the easiest to get wrong. It lists which sources may load scripts, styles, images and connections. A strict CSP is the strongest defense against cross-site scripting, but a wrong one silently breaks your analytics, fonts or payment widget.

Start in report-only mode, which logs violations without blocking anything:

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://www.googletagmanager.com; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'

Watch the browser console, adjust, and switch to enforcing only when the reports are clean. Frameworks that inject inline scripts usually need nonces or hashes for a strict policy, so check your framework's CSP guide.

Headers you can skip

  • X-XSS-Protection is deprecated. Modern browsers ignore it, and the old filter it controlled could itself be abused. Use CSP instead.
  • Expect-CT is obsolete. Certificate Transparency is enforced by browsers now.
  • Public-Key-Pins (HPKP) is removed from browsers and dangerous to use.

How to add them

  • Cloudflare Workers or Pages static assets: a _headers file in your output folder.
  • Netlify: a _headers file or netlify.toml.
  • Vercel: the headers option in your project configuration.
  • Next.js on a Node server: headers() in next.config. Note that this does not apply to a static export, so use your host's mechanism instead.
  • Nginx: add_header directives. Add always so they are sent on error responses too.

A Cloudflare _headers example:

/*
  Strict-Transport-Security: max-age=31536000
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()

Check your result

Open your browser's developer tools, go to the Network tab, click the main document and read the response headers. Or let a scanner do it. Web Scan checks security headers alongside SEO, GEO and performance, and gives each missing header as a fix you can paste into your coding agent. Only scan sites you own or are allowed to test.