What Are HTTP Security Headers?
HTTP security headers are instructions sent by a web server to a browser that control how the browser should handle a website and certain security-sensitive features. They can reduce exposure to common web risks, but they are one layer of a larger security model.
What Do HTTP Security Headers Do?
A browser receives more than HTML when it loads a website. HTTP response headers can tell the browser whether the site should only use HTTPS, which resources may load, how much referrer information may be shared, whether MIME types may be sniffed, and whether certain browser features or framing contexts are allowed.
Which Security Headers Should You Check?
Strict-Transport-Security (HSTS)
HSTS tells a browser that a host should only be accessed using HTTPS for the specified period. It can prevent future HTTP access to the host and helps protect against downgrade-style attacks.
Strict-Transport-Security: max-age=31536000
Content-Security-Policy (CSP)
CSP controls which resources a browser is allowed to load and can restrict scripts, frames, styles, images and other content sources. A carefully designed CSP can reduce the impact of cross-site scripting and related injection attacks.
Content-Security-Policy: default-src 'self'
X-Content-Type-Options
The nosniff value tells browsers to respect the MIME type declared by the server instead of trying to guess it. This helps reduce MIME-sniffing problems.
X-Content-Type-Options: nosniff
Referrer-Policy
Referrer-Policy controls how much information from the current URL may be sent as referrer information when a browser makes another request.
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy
Permissions-Policy controls whether selected browser features can be used by a document or embedded frames. Examples include camera, microphone and other browser capabilities.
Permissions-Policy: camera=(), microphone=()
X-Frame-Options
X-Frame-Options controls whether a page may be loaded in a frame. It can provide protection against clickjacking; for newer deployments, CSP frame-ancestors is generally the more flexible mechanism.
X-Frame-Options: DENY
What Does HSTS Do?
HSTS tells the browser to use HTTPS for future connections to the host for the duration specified by max-age. With includeSubDomains, the policy can also cover subdomains. HSTS should only be enabled with settings appropriate for the domains you control.
What Does CSP Do?
Content Security Policy lets a site define where different types of resources may come from. A policy can restrict scripts and other content sources and can also control framing and other browser behaviours.
CSP is powerful but easy to misconfigure. A policy that is too restrictive can break legitimate functionality, while a policy that is too permissive may provide little protection. It should be tested against the actual application.
What Does nosniff Do?
X-Content-Type-Options: nosniff tells the browser to follow the declared Content-Type rather than attempting MIME-type inference. The server should still send correct Content-Type values.
What Does Referrer-Policy Do?
Referrer-Policy limits the information that may be included in the Referer request header. This is useful when URLs contain paths or parameters that should not be unnecessarily exposed to another origin.
What Does Permissions-Policy Do?
Permissions-Policy lets a site define which browser features are available to the document and to embedded frames. A site can disable features it does not use instead of leaving them unnecessarily available.
What Does X-Frame-Options Do?
X-Frame-Options can prevent a page from being displayed inside a frame and can help mitigate clickjacking. CSP frame-ancestors provides more control over which framing origins are allowed.
What About X-XSS-Protection?
X-XSS-Protection is an old browser feature and is not a modern substitute for Content-Security-Policy. OWASP recommends not relying on it and, where applicable, explicitly disabling the obsolete behaviour rather than treating it as a primary security control.
What Happens When a Security Header Is Missing?
The effect depends on the header. A missing HSTS policy means the browser does not receive that host-level HTTPS enforcement from HSTS. A missing CSP means the application is not receiving the protections provided by its CSP policy. Other missing headers remove their respective browser-side restrictions. A missing header is therefore a configuration signal, not automatically proof of a vulnerability.
Should Security Headers Be Monitored?
Yes, especially when a site relies on a known security configuration. Headers can disappear or change after a deployment, reverse-proxy change, CDN migration or web-server update. External monitoring can detect those changes from the same perspective as a normal visitor.
How Viglar Monitors Security Headers
Viglar checks the HTTP security headers exposed by your website and can detect missing or changed security controls. This helps you notice configuration drift after deployments, hosting changes or other infrastructure updates.
Want to check your security headers?
Run a quick external check with Viglar and inspect the security headers currently exposed by your website.
Check Your Website