Security headers (HSTS, CSP) in plain words
Every time someone opens your site, the server sends the browser not only the content but also a set of hidden instructions, headers. A few of them are security headers: they tell the browser how to protect the visitor from common attacks. They do not change the look, but they close real doors.
The most important headers and what they do
- HSTS: forces the browser to always connect to your site over secure HTTPS, even if someone types
http://. - CSP (Content Security Policy): specifies where the site may load scripts and content from; makes it harder to inject foreign, malicious code.
- X-Content-Type-Options: blocks "guessing" a file's type, which is sometimes abused in attacks.
- X-Frame-Options: prevents your site from being embedded in someone else's frame (a defence against clickjacking).
Why they are worth having
These headers cost nothing and clearly raise the level of protection for visitors. Tools that assess site security also check them; their absence lowers the "security score" that more and more people check (partners, audits, clients).
CSP is the most powerful of these headers, but also the most demanding; set incorrectly it can block the site's own scripts. That is why you deploy it with a test, not by eye.
Set once, benefit forever
The headers are configured at the server level. It is a one-off job that then simply works in the background on every visit to the site.
We will close this for you
As part of a security review we choose and set the headers so they protect rather than break the site, with a test after deployment.
Want to raise your site's security level? Reach out, we will start with a review.