Security headers are the simplest, highest-ROI security improvement you can make to a web application. Unlike patching vulnerabilities or implementing complex WAF rules, security headers are a one-time configuration change that provides immediate protection against entire classes of attacks.
The Essential Headers
Content-Security-Policy (CSP): Prevents XSS by controlling which resources can load on your page. A strict CSP eliminates ~60% of web injection attack vectors. Start with default-src 'self' and expand from there.
X-Frame-Options / frame-ancestors: Blocks clickjacking attacks. DENY prevents your pages from being embedded in iframes on any domain. Essential for banking, healthcare, and any authenticated application.
Strict-Transport-Security (HSTS): Forces HTTPS connections for a configurable period. Use max-age=31536000; includeSubDomains; preload for maximum protection.
X-Content-Type-Options: nosniff prevents browsers from MIME-sniffing responses away from declared content types — a common vector for drive-by downloads.
Testing Your Headers
Before deploying, test your header configuration against a comprehensive checker. Tools like WebShield scan your site and provide actionable remediation guidance for each missing or misconfigured header.
Common Mistakes
- Setting CSP in report-only mode indefinitely (provides no actual protection)
- Using
unsafe-inlinein CSP (negates 80% of the benefit) - Missing HSTS on subdomains while setting it on root domain
- Forgetting to test after CDN or reverse proxy changes
A comprehensive security header audit takes 30 minutes to implement correctly. The protection it provides against automated scanning and opportunistic attacks is immediate.
