A website needs six response headers to close most of the browser-level attacks a static page can prevent: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, a frame-control rule, Referrer-Policy and Permissions-Policy. None touch the page's code. Each is a line in the server or CDN configuration that tells the browser what to refuse before it ever renders the response.
Which security headers does a website need?
Six headers cover almost every browser-level attack a response can prevent on its own, with no change to the page's HTML or JavaScript.
| Header | Stops | Good default |
|---|---|---|
| Strict-Transport-Security | A downgrade back to plain HTTP | max-age=63072000; includeSubDomains |
| Content-Security-Policy | Injected and inline scripts running | script-src 'self' |
| X-Content-Type-Options | A response MIME-sniffed into script | nosniff |
| Frame-ancestors (CSP) / X-Frame-Options | Clickjacking via a hidden iframe | frame-ancestors 'self' |
| Referrer-Policy | Full URLs leaking to third-party links | strict-origin-when-cross-origin |
| Permissions-Policy | Embedded content misusing camera or mic | camera=(), microphone=() |
Six headers cover most of the risk. Each is a response-header config change, not an application rewrite.
What does a missing header actually cost?
None of these six throw a visible error. A page that has no security headers loads and behaves in exactly the same way as one that has all of them, right up until the attack they exist to stop finds the gap.
Trackers fire before anyone consents
How do you check your own headers in two minutes?
- Open the browser's devtools, the Network tab, reload the homepage, click the document request, and read the Response Headers.
- Confirm Strict-Transport-Security is present with a max-age measured in years, not that the page merely loads over HTTPS.
- Read the Content-Security-Policy's script-src value. Its absence, or an 'unsafe-inline' or wildcard source, means it exists without doing much.
- Check X-Content-Type-Options is nosniff and a frame-control header (frame-ancestors in the CSP, or X-Frame-Options) is present.
- Run a free Snapshot of the homepage. It grades the response against the same rubric and names exactly which header is missing or weak.
Headers are one slice of the Trust pillar
A header scan is the visible part. Auditaar's Trust pillar reads further into the same response and the domain around it:
- TLS and HTTPS enforcement. Protocol version, certificate issuer and expiry, and whether the HTTP version actually redirects rather than serving a second, insecure copy.
- Cookie flags. Whether session and tracking cookies set Secure, HttpOnly and SameSite, so a cookie cannot be read or replayed from somewhere it should not be.
- Front-end library exposure. Known CVEs matched against the script URLs and file banners a page actually loads, not a full dependency scan of code never served to a browser.
- Malware and phishing reputation. Whether the domain or its key pages are currently flagged on Google's Safe Browsing threat lists, read live, and reported as a floor rather than a certificate of safety.
Does a header that exists mean it actually works?
What does fixing all six look like in practice?
Security headers FAQ
Do security headers affect SEO or AI Visibility?
Security headers are not a direct ranking signal. They sit in the same Trust pillar that an audit scores, along with AI Visibility, findability, and the rest. Missing headers can be seen by anyone who inspects the response, and that includes a security-minded buyer who is reviewing the site.
Can I add a Content-Security-Policy without breaking the site?
Not safely in one step on a page with years of inline scripts and third-party tags. Deploy it in Content-Security-Policy-Report-Only mode first, read what it would have blocked, then tighten script-src to match what actually loads before enforcing it.
Is a passing security-header grade the same as being secure?
No. Headers close a specific set of browser-level attacks and say nothing about the server, the database or the code behind the page. Auditaar's Safe Browsing check is explicit about the same limit: it reports whether a site is currently flagged for malware or phishing, as a floor, never a certificate of safety.
Auditaar grades HTTPS enforcement, TLS, cookie flags and all six security headers against a printed rubric, reads the Content-Security-Policy as an actual policy rather than a header that exists, and checks live for malware and phishing flags, all from a single URL. Run a free Snapshot, or read how to read a website audit.