Security Headers: Why Your Website Needs Them and How to Fix Missing Ones
Troubleshooting guide for common security header issues. Learn what each header does, how to test your site's header configuration, and how to fix missing or misconfigured security headers.
Key Takeaways
- HTTP security headers instruct browsers to enforce protection mechanisms that prevent common attacks — cross-site scripting (XSS), clickjacking, data injection, and protocol downgrade attacks.
- Test your site at securityheaders.com or observatory.mozilla.org.
- CSP blocks legitimate resources: Start with `Content-Security-Policy-Report-Only` to collect violations without breaking functionality.
Why Security Headers Matter
HTTP security headers instruct browsers to enforce protection mechanisms that prevent common attacks — cross-site scripting (XSS), clickjacking, data injection, and protocol downgrade attacks. Missing headers leave your site vulnerable to attacks that are trivially prevented by a few lines of server configuration.
Essential Headers
| Header | Purpose | Recommended Value |
|---|---|---|
| Content-Security-Policy | Prevent XSS, injection | Restrict sources per type |
| X-Content-Type-Options | Prevent MIME sniffing | nosniff |
| X-Frame-Options | Prevent clickjacking | DENY or SAMEORIGIN |
| Strict-Transport-Security | Force HTTPS | max-age=63072000; includeSubDomains |
| Referrer-Policy | Control referrer leakage | strict-origin-when-cross-origin |
| Permissions-Policy | Disable unused APIs | Disable camera, microphone, geolocation |
Diagnosing Missing Headers
Test your site at securityheaders.com or observatory.mozilla.org. Both provide letter grades and specific recommendations. You can also inspect headers directly with curl -I https://yoursite.com and check for the presence of each header listed above.
Common Issues and Fixes
CSP blocks legitimate resources: Start with Content-Security-Policy-Report-Only to collect violations without breaking functionality. Add approved sources incrementally until the policy is clean.
HSTS breaks HTTP development: Only add HSTS in production. Use a short max-age initially (86400) and increase after confirming HTTPS works correctly.
X-Frame-Options conflicts with embeds: If your site intentionally appears in iframes on specific partner sites, use CSP frame-ancestors instead — it supports multiple allowed origins.
Use the Peasy security header analyzer to scan your site and get actionable recommendations for each missing or misconfigured header.