HTTP Security Headers: A Practical Guide

What are HTTP security headers?

HTTP security headers are response headers that instruct the browser to enforce a security policy for your site. They do not replace secure code — they harden the browser boundary so bugs in your app become far less exploitable. The most important ones in 2026 are Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and X-Frame-Options.

The essential headers, ranked

1) Strict-Transport-Security forces HTTPS. 2) Content-Security-Policy stops XSS and mixed content. 3) X-Content-Type-Options blocks MIME sniffing. 4) Referrer-Policy controls how much URL data leaks to third parties. 5) Permissions-Policy restricts powerful browser features. 6) X-Frame-Options (or frame-ancestors in CSP) prevents clickjacking.

Nginx example

Add these once at the server or location block level:

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';" always;
add_header X-Content-Type-Options nosniff always;
add_header Referrer-Policy strict-origin-when-cross-origin always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Apache example

Requires mod_headers:

Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Header always set Content-Security-Policy "default-src 'self'; frame-ancestors 'none';"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

Cloudflare

Use Transform Rules → Modify Response Header, or a Cloudflare Worker. Transform Rules are the fastest path and free on every plan. Cloudflare will not add these for you automatically — you must opt in per zone.

Common mistakes

Setting HSTS without HTTPS working on every subdomain, using unsafe-inline in CSP alongside a nonce (nonces are ignored when unsafe-inline is present in Level 2 in some contexts), forgetting `always` on Nginx (headers are otherwise skipped on error responses), and shipping X-XSS-Protection which is deprecated and can create vulnerabilities.