6 HTTP Security Headers Your Site Is Probably Missing (and how to fix each one)
Run any random production site through a headers check and odds are it's missing at least half of the headers below. Not because anyone decided against them — usually because nobody ever added them in the first place. They cost nothing, take one line to set, and most frameworks don't set them for you by default. Here's what each one actually does, and the one-liner to add it in a few common…
Six crucial HTTP security headers often go missing on websites, leaving them vulnerable to attacks. These headers can be easily added with a single line of code.
The first header, Strict-Transport-Security (HSTS), instructs the browser to never connect to the site over plain HTTP, even if someone types or links to it that way. Without HSTS, a single stray link could lead to a downgrade-to-HTTP attack.
Content-Security-Policy (CSP) is the next header that plays a significant role in preventing cross-site scripting (XSS) attacks. It specifies exactly which origins are allowed to supply scripts, styles, images, and other resources. This way, even if an attacker manages to inject a script tag, the browser will refuse to run it if it's not from an allowed source.
Next, the X-Frame-Options header prevents your pages from being loaded inside a hidden iframe on someone else's site, a setup known as clickjacking. The DENY value stops your pages from being framed, while the frame-ancestors directive, if supported, offers a more modern alternative.
The X-Content-Type-Options header ensures that browsers treat the content as specified by the Content-Type header, preventing browsers from incorrectly interpreting a file type and executing it as a different type.
Referrer-Policy controls the amount of information, including query strings, that is sent to the destination site when a visitor clicks away from your site. A good default is strict-origin-when-cross-origin, which sends the full URL on same-origin navigation and only the origin on cross-origin navigation.
Lastly, the Permissions-Policy header explicitly turns off browser features your site doesn't use, such as camera, microphone, and geolocation. This is an extra layer of protection in case a third-party script tries to access these features despite not being used by your site.
Lastly, revealing your server type and web framework through headers like "Server: nginx/1.18.0" and "X-Powered-By: Express" can give attackers valuable information, making it easier for them to launch known attacks. Disabling these headers can help mitigate this risk.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
