Security Headers: The Invisible Armor Your Website Probably Isn't Wearing

Every time someone loads your website, your server sends a set of invisible instructions along with the page — headers that tell the browser how to behave. A handful of them are security instructions, each one switching on a protection browsers already know how to enforce. Most small-business sites send almost none of them, which is a little like owning a car with airbags and never plugging them in.

HSTS: never talk over an insecure line

Strict-Transport-Security tells browsers to connect to your site over HTTPS only, every time, for a period you choose — commonly a year. Without it, a visitor who types your bare domain makes one unencrypted request first, and an attacker on the same coffee-shop network can intercept that hop. With it, the browser refuses insecure connections outright.

CSP: an allowlist for code

Content-Security-Policy declares which domains are permitted to run scripts on your pages. It's the most powerful header and the fussiest to configure — but even a basic policy is a serious obstacle to card skimmers, because injected code that tries to load from or send data to an unapproved domain simply gets blocked by the browser. Start in report-only mode, watch what it would have blocked, then enforce.

X-Frame-Options: nobody wraps your site

This header stops other sites from embedding your pages inside an invisible frame — the setup for clickjacking, where a visitor believes they're clicking a harmless button but is really clicking your site underneath. One line, almost never a downside: DENY, or SAMEORIGIN if you embed your own pages.

The five-minute additions

Three more headers are nearly free wins. X-Content-Type-Options: nosniff stops browsers from executing files that pretend to be something they're not. Referrer-Policy limits how much of your URLs leak to other sites when visitors click away. Permissions-Policy switches off browser features you never use — camera, microphone, location — so injected code can't quietly request them.

Grade yourself in thirty seconds

Free scanners such as securityheaders.com fetch your homepage and grade the response from A to F. Most unconfigured sites score a D or worse — and can reach a B in under an hour, since headers are added with a few lines in your server config or a security plugin rather than any change to the site itself.

Headers are one layer of a defense that needs several. Trust Guard's security scanning checks how your site presents itself to browsers and attackers alike, flagging the weak spots — missing armor included — before someone else inventories them for you.