Question 1

What are HTTP security headers?

Accepted Answer

HTTP security headers are response headers that a web server sends to the browser to control security behaviours. They tell the browser how to handle the content, preventing attacks like Cross-Site Scripting (XSS), clickjacking, MIME sniffing, and data injection. They are one of the easiest security improvements you can make to any website.

Question 2

What is the most important security header?

Accepted Answer

Content-Security-Policy (CSP) is generally considered the most impactful, as it prevents XSS attacks by controlling which resources can be loaded. Strict-Transport-Security (HSTS) is also critical as it forces HTTPS for all connections. Both together provide strong baseline protection.

Question 3

How do I add security headers to my website?

Accepted Answer

For Nginx: add headers inside your server {} block using add_header. For Apache: use Header set in .htaccess or httpd.conf. For Next.js: configure them in next.config.js headers(). For Cloudflare: use Transform Rules or Workers. For Vercel: configure in vercel.json headers array.

Question 4

What is HSTS and why is it important?

Accepted Answer

HTTP Strict Transport Security (HSTS) tells browsers to always use HTTPS when connecting to your site — even if someone types http:// or clicks an HTTP link. This prevents SSL stripping attacks. The preload directive submits your domain to browser preload lists, providing even stronger protection.

Question 5

What is Content Security Policy?

Accepted Answer

CSP is a browser security feature that restricts what resources a page can load and from where. It prevents XSS attacks by blocking inline scripts and unauthorized external sources. A typical policy looks like: default-src 'self'; script-src 'self' 'nonce-...'. Start with report-only mode to test without breaking your site.

Question 6

Will adding security headers break my website?

Accepted Answer

It can if not configured carefully. Content-Security-Policy in particular requires careful setup — a too-strict policy can break third-party scripts, fonts, and images. Always test with Content-Security-Policy-Report-Only first. HSTS, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy are generally safe to add immediately.

Free Security Headers Checker

Frequently Asked Questions