Skip to main content
← All articles
TutorialPublished October 2, 20262 min read

Security Headers I Enable on Client Websites

A practical set of HTTP security headers for business sites: HTTPS, HSTS, nosniff, frame options, referrer policy, and what to skip on day one.

SecurityHeadersHTTPSHSTS
On this page

Most client sites do not need a custom WAF on day one. They do need boring HTTP headers so browsers stop guessing about HTTPS, framing, and content types.

I add these after the certificate is valid—not as a replacement for updates, backups, or sane admin passwords.

The short list

Header Why
Strict-Transport-Security Forces HTTPS after the first secure visit
X-Content-Type-Options: nosniff Stops MIME sniffing
Referrer-Policy Limits how much URL leaks to third parties
X-Frame-Options or CSP frame-ancestors Reduces clickjacking
Permissions-Policy Turns off camera/mic/geolocation you do not use

HSTS, carefully

Strict-Transport-Security: max-age=15552000; includeSubDomains is reasonable once every subdomain you care about already serves HTTPS.

Do not enable preload on a fresh domain until you are sure mail and staging hosts will not break. A preload mistake is painful to undo.

What I usually skip at launch

A strict Content-Security-Policy is worth it, but it breaks inline scripts, tag managers, map embeds, and page builders if you copy a template blindly. Start with Content-Security-Policy-Report-Only, watch violations, then enforce.

Also skip:

  • hiding the server banner as your only “security” task;
  • security plugins that scan on every page view and destroy TTFB;
  • blocking Googlebot in the name of hardening.

Where to set them

  • Apache: Header set in .htaccess or the vhost, after mod_headers is on.
  • Nginx: add_header on the HTTPS server block—remember they are not inherited the way people expect.
  • Cloudflare: Transform Rules or a configuration snippet, and do not duplicate conflicting values from origin and edge.

Check the live response:

curl -sI https://example.com | grep -iE 'strict-transport|content-type-options|referrer-policy|frame-options|permissions-policy'

Verify in the browser

Open DevTools → Network → the document → Response Headers. Then load the homepage, a form, and one embedded map or video. If a widget disappears, the header is too strict for that page—loosen that directive, do not delete the whole set.

WhatsApp