HTTP Security Headers
What HTTP Security Headers Are and How They Work
HTTP security headers are extra instructions that a web server sends to the browser along with each response, telling it how to handle the page safely. Visitors never see them, but the browser reads and enforces them.
Headers are a defensive layer, not a repair. They can stop certain kinds of attack from working in the browser, such as a page being embedded in a hidden frame. They cannot fix flaws in the website's code, and they do not stop attacks that happen on the server, such as a database being queried with malicious input.
The Main Headers and What Each One Protects Against
Four headers are common enough to understand well:
- X-Frame-Options controls whether other sites may display your page inside a frame. It is a main defence against clickjacking. A typical value is
X-Frame-Options: SAMEORIGIN, which allows framing only by your own site. - X-Content-Type-Options tells the browser to trust the declared file type. The value
nosniffstops browsers from guessing a file's type, which could otherwise turn an uploaded file into executable script. - Referrer-Policy controls how much of the current page address is sent to other sites when a visitor follows a link. It helps keep private paths and query details from leaking.
- Permissions-Policy declares which browser features, such as the camera, microphone or location, the page and its embedded frames may use.
Why Headers Are Only One Layer of Defence
A header only protects visitors whose browsers support it, and only when the server actually sends it. Headers are often set in server configuration or in the website software, and a change in one place can silently remove them. Their presence should be checked after every major update or migration.
Stronger protection against script injection comes from the Content-Security-Policy header, which has its own article. Transport settings such as HSTS are covered in the SSL category. Headers work best when combined with secure code, input validation and a web application firewall.
Frequently asked questions
Do security headers protect against SQL injection?
No. Security headers give instructions to the browser, while SQL injection exploits how the server builds database queries. Preventing it requires safe coding practices such as prepared statements and input validation, with a web application firewall as an extra layer.
How can I see which security headers a website sends?
The browser's developer tools show response headers in the network panel for any page. Several online header-checking services can also list them. Either method shows what the browser receives, which is the only thing headers can influence.