Security headers are short instructions your web server sends with every page, telling the visitor’s browser how to protect them: use HTTPS only, don’t let other sites frame this page, don’t guess file types. Five of them can usually be added in about 15 minutes without changing how your site looks. A free scan shows which ones you’re missing.
Key takeaways
- Check your site for free with Mozilla’s HTTP Observatory. It grades from A+ down to F.
- HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy are quick, low-risk wins.
- Content Security Policy is the most powerful header and the hardest to get right. Test it in report-only mode first.
- Headers harden the browser side. They don’t replace updates, scans or a firewall.
What are security headers?
Every time someone loads a page, your server sends hidden information along with it, called HTTP headers. Some are routine, such as the file type. Security headers are the ones that switch on protections built into modern browsers.
Without them, the browser falls back to looser defaults. That leaves gaps attackers use: loading your site over plain HTTP, framing your pages inside a fake site to trick clicks, or running injected scripts. Headers close those gaps for every visitor, at almost no cost.
Which security headers does a small business website need?
These six cover most sites. The starter values follow the OWASP HTTP Headers Cheat Sheet, adjusted slightly for WordPress.
| Header | What it does | Starter value |
|---|---|---|
| Strict-Transport-Security (HSTS) | Forces HTTPS on every future visit | max-age=31536000 |
| X-Content-Type-Options | Stops the browser guessing file types | nosniff |
| X-Frame-Options | Stops other sites showing your pages in a frame | SAMEORIGIN |
| Referrer-Policy | Limits what your URLs reveal to other sites | strict-origin-when-cross-origin |
| Permissions-Policy | Switches off features you don’t use, such as the camera | camera=(), microphone=(), geolocation=() |
| Content-Security-Policy | Controls which scripts and files may load | Built per site, tested first |
OWASP suggests X-Frame-Options DENY. SAMEORIGIN is the safer choice on WordPress, because the Customizer and some page builders show previews of your own pages in a frame. One old header, X-XSS-Protection, is no longer recommended: OWASP advises leaving it out or setting it to 0.
How do I check my website’s security headers?
- Open the scanner. Go to Mozilla’s HTTP Observatory on MDN and enter your domain.
- Read the grade. Every site starts at 100 points. Missing headers cost points, and good setups earn bonus points. A score of 100 or more is an A+ (MDN scoring).
- Note what failed. The results list each test with a short explanation. That list is your to-do list.
Don’t be alarmed by a D or an F. Many small business sites are missing several of these headers, simply because nobody switched them on. It’s a configuration gap, not a sign you’ve been hacked.
How do I add security headers?
Where you add them depends on your setup. Your host’s control panel or server configuration is the best place, because the headers then apply to every page and file. A content delivery network such as Cloudflare can add them too. WordPress plugins work, but only for pages WordPress itself serves.
- Back up the configuration file. If something goes wrong, you can put it straight back.
- Add the five quick headers. Use the starter values from the table. Your host or developer can do this in minutes.
- Clear any caches. Otherwise old pages may still be served without the new headers.
- Test the site. Check forms, payment pages, embedded maps and videos, and the WordPress editor.
- Scan again. Run the Observatory scan to confirm each header now passes.
On an Apache server, the five quick headers look like this in the .htaccess file. Nginx uses the same values with the add_header directive.
Header always set Strict-Transport-Security "max-age=31536000"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"Warning: Only add HSTS once HTTPS works everywhere on your site. Browsers remember it for the full max-age, and they won’t let visitors click past a certificate error on a site that uses it (MDN). Add includeSubDomains only when every subdomain has HTTPS too.
Why is Content Security Policy harder?
Content Security Policy (CSP) lists the places your site is allowed to load scripts and other files from. Its main job is defending against cross-site scripting, where an attacker slips their own code into your pages (MDN). That matters for WordPress: cross-site scripting made up 46% of the vulnerabilities Wordfence saw disclosed in 2024 (Wordfence).
The difficulty is that a typical small business site loads scripts from many places: analytics, chat widgets, payment forms, fonts and video embeds. Miss one and that feature stops working. So start with the Content-Security-Policy-Report-Only header. It reports what would be blocked without blocking anything, and you tighten the list over a week or two before switching to the real policy.
Are security headers enough to secure my website?
No, and the scanner says so itself. Mozilla notes that the Observatory doesn’t test for outdated software or vulnerable plugins, and that an A+ doesn’t mean a site is perfectly secure. Headers protect visitors’ browsers. They don’t stop an attacker using an outdated plugin to get into your server.
The other layers still matter: updates, a firewall, malware scanning and file integrity monitoring to catch changes as they happen. Our website security monitoring covers those day to day, and secure web hosting adds protection at the server.
For the wider business picture, read our guide to small business cyber security in Australia. Headers also fit neatly into the essential eight for small business mindset of hardening what you already have. If you’d rather someone owned all of this, compare our website maintenance plans.
Frequently asked questions
Do security headers affect SEO?
Not directly. Google doesn’t rank pages on security headers. HSTS does make sure visitors always reach the HTTPS version of your site, and a safer site is less likely to be hacked and flagged with a browser warning, which would hurt your traffic.
Can security headers break my website?
The five quick headers rarely do. X-Frame-Options can affect pages you deliberately embed elsewhere, and HSTS will lock out any part of the site without HTTPS. Content Security Policy is the one most likely to break features, which is why you test it in report-only mode first.
What is a good security headers grade?
Aim to move up from wherever you start, then work towards an A. The five quick headers and a proper HTTPS redirect lift most sites a long way. A top grade on Mozilla’s HTTP Observatory usually also needs a Content Security Policy, which takes longer to set up and test properly.
Can I add security headers with a WordPress plugin?
Yes, several security plugins can. But plugins only add headers to pages WordPress serves, not to images, files or cached pages served directly by the server. Adding them in the server configuration or at your CDN covers everything.
What does HSTS stand for?
HTTP Strict Transport Security. It tells browsers to only ever connect to your site over HTTPS, and to upgrade any plain HTTP link automatically. Once a browser has seen it, it remembers for the time set in max-age, usually a year.
Sources
- HTTP Security Response Headers Cheat Sheet, OWASP
- HTTP Observatory FAQ, MDN
- HTTP Observatory tests and scoring, MDN
- Strict-Transport-Security, MDN, September 2026
- Content Security Policy (CSP), MDN
- 2024 Annual WordPress Security Report, Wordfence, April 2025