What Are HTTP Security Headers?

HTTP security headers are directives sent by a web server to a user's browser that instruct it to behave in specific ways. They provide an additional layer of security by helping to mitigate attacks and reduce vulnerabilities.

Despite being one of the simplest security measures to implement, many websites still fail to use them properly. A recent study found that only 22% of the top 1 million websites implement all recommended security headers.

Security headers are a core part of ClearAudit's Application Security scan. We check every recommended header and score your implementation, so you know exactly where you stand.

Essential Security Headers

Content-Security-Policy (CSP)

The Content-Security-Policy header is arguably the most powerful security header. It tells the browser which sources of content are allowed to be loaded on the page — and blocks everything else.

Example: Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-random123'; style-src 'self'; img-src 'self' data: https:; connect-src 'self' https://api.example.com

CSP prevents:

• Cross-Site Scripting (XSS) attacks — the most common web vulnerability
• Data injection attacks and data exfiltration
• Clickjacking (when combined with the frame-ancestors directive)
• Mixed content issues that could expose data

ClearAudit's Application Security scan evaluates your CSP policy, checks for overly permissive directives like unsafe-inline and unsafe-eval, and provides specific recommendations for tightening your policy.

Strict-Transport-Security (HSTS)

HSTS tells browsers to only communicate with the server over HTTPS, even if the user types HTTP in the address bar or clicks an HTTP link.

Example: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

HSTS prevents:

• Protocol downgrade attacks where attackers force HTTP connections
• Cookie hijacking through unencrypted initial requests
• Man-in-the-middle attacks during the initial connection before redirect

ClearAudit's Network & Transport scan checks for HSTS enforcement and validates that your max-age value is at least one year (31,536,000 seconds).

X-Content-Type-Options

This header prevents browsers from MIME-sniffing a response away from the declared content type — a common attack vector for serving malicious content.

Example: X-Content-Type-Options: nosniff

Prevents:

• MIME confusion attacks where browsers interpret files as executable
• Drive-by downloads through content type manipulation
• Unauthorized script execution from uploaded files

X-Frame-Options

Controls whether your page can be embedded in an iframe by other websites. Without this header, attackers can overlay your site with invisible elements to trick users into clicking.

Example: X-Frame-Options: DENY

Prevents:

• Clickjacking attacks where users unknowingly click hidden buttons
• UI redressing that tricks users into revealing credentials
• Phishing through framing your legitimate site

Referrer-Policy

Controls how much referrer information is included with requests when users navigate away from your site.

Example: Referrer-Policy: strict-origin-when-cross-origin

Prevents:

• Leaking sensitive URL paths (like password reset tokens) to third-party services
• User tracking through referrer data by analytics and advertising networks
• Exposure of internal URL structures that could aid attackers

Permissions-Policy

Controls which browser features and APIs can be used on the page, preventing third-party scripts from accessing sensitive capabilities.

Example: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(self)

Prevents:

• Unauthorized access to device camera and microphone
• Privacy violations through third-party scripts that request geolocation
• Abuse of powerful browser APIs like payment or USB access

How to Implement Security Headers

For Nginx

Add the following directives to your server block:

add_header Content-Security-Policy "default-src 'self';" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

For Apache

Add the following to your .htaccess or virtual host configuration:

Header always set Content-Security-Policy "default-src 'self';"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

For Vercel

Add a headers array in your vercel.json with X-Content-Type-Options set to "nosniff", X-Frame-Options set to "DENY", and Referrer-Policy set to "strict-origin-when-cross-origin" for all routes.

ClearAudit's Security Header Grading

ClearAudit grades your security header implementation as part of the Application Security category:

Grade	Description
A+	All recommended headers with optimal configuration
A	All essential headers present with good configuration
B	Most headers present, minor configuration gaps
C	Some important headers missing
D	Critical headers missing
F	No security headers implemented

After your scan, ClearAudit provides specific remediation steps for each missing or misconfigured header, complete with copy-paste configuration snippets.

Common Mistakes

1. Setting CSP too loosely: Using unsafe-inline or unsafe-eval defeats much of CSP's purpose. ClearAudit specifically flags these.
2. Short HSTS max-age: Use at least one year (31,536,000 seconds). ClearAudit flags max-age values below this threshold.
3. Missing headers on API endpoints: Security headers should be set on all responses, not just HTML pages.
4. Not testing after implementation: Incorrect CSP can break website functionality. Deploy with report-only mode first.

Conclusion

Security headers are a low-effort, high-impact security measure that every website should implement. They provide essential protection against XSS, clickjacking, and data interception, and they demonstrate your commitment to security.

Check your security headers — Run a ClearAudit scan to get a detailed analysis of your website's security header configuration with specific fix instructions.

Related reading

• Why Web Application Security Matters More Than Ever in 2026 — With over 4.5 billion internet users relying on web applications daily, the attack surface has never been larger. Here's why securing your web apps is non-negotiable.
• How to Check If a Website Is Safe: The Complete Guide for 2026 — With AI-generated phishing sites on the rise, knowing how to verify a website's safety is critical. Here's every method — from quick visual checks to professional-grade scanning.
• React Security Best Practices: How to Secure Your React App in 2026 — React prevents some attacks by default, but leaves many security decisions up to you. Here are the 10 vulnerabilities we find in 98% of React apps — and how to fix every one.