Skip to content
LaunchSafer

Essential security headers checklist

By the LaunchSafer team ·

The HTTP security headers every website should send, what each one protects against, safe starting values, and how to check yours in under a minute.

Security headers are instructions your server sends with every page. They cost nothing to add, they don't change how your site looks, and they close off whole classes of attacks. Here are the ones worth setting on almost every site.

The checklist

1. Strict-Transport-Security (HSTS)

Tells browsers to only ever use HTTPS for your domain.

  • Starting value: max-age=31536000; includeSubDomains
  • Only add includeSubDomains if every subdomain supports HTTPS.
  • Make sure plain HTTP already redirects to HTTPS.

2. Content-Security-Policy (CSP)

Limits where scripts, styles and other resources can load from, which blunts cross-site scripting (XSS).

  • Start with default-src 'self' and add the third-party domains you actually use.
  • Avoid 'unsafe-inline' for scripts where you can. Use nonces or hashes instead.
  • Try it first as Content-Security-Policy-Report-Only so nothing breaks while you tune it.

3. Clickjacking protection

Stops other sites from loading yours in an invisible frame and tricking people into clicking.

  • X-Frame-Options: DENY (or SAMEORIGIN if you frame your own pages)
  • Or the CSP equivalent: frame-ancestors 'none'

4. X-Content-Type-Options

Stops browsers from guessing file types, which can turn an upload into a script.

  • Value: nosniff

5. Referrer-Policy

Controls how much of your URLs are shared with other sites when visitors click a link.

  • Value: strict-origin-when-cross-origin

6. Permissions-Policy

Turns off browser features you don't use, such as the camera, microphone and location.

  • Example: camera=(), microphone=(), geolocation=()

Beyond headers

Headers are one layer. Also check that:

  • Your TLS certificate is valid and not close to expiry.
  • No page loads images or scripts over plain HTTP (mixed content).
  • Cookies use the Secure, HttpOnly and SameSite flags.
  • Your server doesn't advertise its exact software version.

Where to set them

Most hosts and CDNs let you add response headers without touching your code. In Cloudflare, use Transform Rules; in Nginx, add_header; in Next.js, the headers() option in next.config.

Check yours

Run the free security headers checker to see which headers your site sends and which are missing, with a fix for each. For the bigger picture, read website security basics.

Related articles