HTTP security headers: the essential list
Security headers are instructions your server sends with every response, telling the browser how to protect your users. They cost almost nothing to add, yet many sites are missing several of them.
This guide covers the headers every web application should send and what each one does.
What goes wrong without them
Without these headers, the browser falls back to permissive defaults. It will let your pages be framed by other sites, guess content types, load resources over plain HTTP and share full URLs with third parties. Each gap widens the impact of other bugs, such as XSS or clickjacking.
The headers every site should send
- Content-Security-Policy: limits where scripts and other resources may load from.
- Strict-Transport-Security: forces HTTPS on every visit.
- X-Frame-Options or CSP
frame-ancestors: stops clickjacking. - X-Content-Type-Options: nosniff: stops MIME-type guessing.
- Referrer-Policy and Permissions-Policy: limit what the page shares and can access.
How to prevent it
- Set headers centrally, in your web server, reverse proxy or framework middleware, so every response gets them.
- Start with a report-only Content-Security-Policy, then enforce it.
- Remove headers that reveal software versions, such as
X-Powered-By. - Re-check headers after every infrastructure change.
How Vooki Pro helps
- Checks for missing or weak CSP, HSTS (including preload), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and CORS.
- Flags version-revealing headers such as
X-Powered-By, and mixed content. - Consolidates header findings per origin, so one missing header is one finding, not hundreds.
- Scheduled scans catch headers that disappear after a deployment.
Frequently asked questions
Which security headers are most important?
Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or CSP frame-ancestors) and X-Content-Type-Options give the biggest protection for the least effort.
How do I check my security headers?
A DAST scan checks every response for missing and weak security headers and reports them per origin.
Try Vooki Pro free for 7 days
See every missing security header on your site in one scan. The trial unlocks every feature for 7 days, and scanning runs on your own machine.