Add missing security headers
A few lines of server config that block common attacks and remove browser warnings.
What it means
Security headers are instructions your server sends with every page telling browsers to enforce protections: restricting scripts (Content-Security-Policy), forbidding framing (X-Frame-Options), forcing HTTPS, and more.
Why it matters
Headers are invisible when present and a liability when missing: clickjacking, script injection, and protocol downgrade attacks all rely on their absence. Security scanners and enterprise customers check them.
How to fix it
- Start with the easy wins in your server config or CDN rules: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and Strict-Transport-Security.
- Add a Content-Security-Policy gradually: start in report-only mode, watch the console, then enforce.
- On Cloudflare, 'Transform Rules' or a Worker can set headers without touching your app; on Nginx use add_header; on Netlify/Vercel use headers config files.
- Verify with securityheaders.com until you score A.
Helpful tools
- securityheaders.com
- Mozilla Observatory
Not sure if this affects your site? Analyze your website for free or compare it with a competitor.
Related guides
- Serve the site over HTTPS: The padlock in the address bar — table stakes for trust, SEO, and browser features.
- Fix mixed content warnings: Some assets on your HTTPS page are still loaded over insecure HTTP.
- Add a privacy policy: Legally required in most jurisdictions, and a visible honesty signal.