Security Header
Definition
Security headers are a small, well-known set sent alongside the HTML. The working list is: Content-Security-Policy, which limits where scripts, styles and frames may come from; X-Frame-Options, the older switch controlling whether the page may be framed at all; Referrer-Policy, which decides how much of the current address is passed on; Strict-Transport-Security, which pins the site to HTTPS for a stated number of seconds; X-Content-Type-Options set to nosniff, which stops the browser second-guessing a declared MIME type; and Permissions-Policy, which turns off browser features such as camera, microphone and geolocation. Two older entries, X-XSS-Protection and Expect-CT, are deprecated and can be left off. None of them change the file; they change what the browser is willing to do with it.
Why It Matters
Headers are the cheapest security work available on a static site, because there is no code to write. A typical set is six lines of configuration and closes off framing, mixed content, MIME confusion and a large share of script injection in one go. They are also the thing audits and procurement questionnaires check first, usually with an automated scanner that grades a site on which headers are present. The catch is that two of them can break a working page: a strict Content-Security-Policy stops inline scripts, and Strict-Transport-Security with a long max-age commits every visitor's browser to HTTPS for months, which is awkward if a subdomain is not ready for it.
How It Works
On a static host the headers are attached by the edge server as it answers each request, not written into the file, so they apply to every page served under the site without any change to the HTML. A reasonable baseline for a published page is X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, X-Frame-Options DENY or a frame-ancestors directive, and Strict-Transport-Security with max-age 31536000. Add a Content Security Policy once you know whether the page carries inline code. Verify with a browser's network panel or a curl request showing response headers; a scanner such as an online header check will list what is missing. Headers on a cached response are stored by the cache with it, so a change may need a cache invalidation before visitors see it.
Real-World Example
A studio publishes a client portal page at atlas-portal.99helpers.site holding links and a password-protected download. The page scores poorly on an automated header check with nothing but a content type set. Adding nosniff, a referrer policy and a framing rule takes the report from three warnings to none, and the page itself renders exactly as before — nothing in the HTML changed.
Common Mistakes
- ✕Adding headers as meta tags in the HTML — only Content-Security-Policy works that way, and even then frame-ancestors is ignored
- ✕Setting a long Strict-Transport-Security max-age before every subdomain serves HTTPS, which locks visitors out of the ones that do not
- ✕Chasing a perfect scanner grade with a policy so tight the page stops working, instead of starting in report-only mode
- ✕Assuming headers protect the file itself — they instruct browsers, and do nothing about a direct download or a request from a script on a server
Related Terms
Content Security Policy
A response header that tells the browser which sources a page is allowed to load scripts, styles, images and frames from. Anything outside the policy is blocked before it runs.
X-Frame-Options
An older response header that tells the browser whether a page may be displayed inside a frame or iframe. It takes two useful values, DENY and SAMEORIGIN.
Referrer-Policy
A response header that controls how much of the current URL the browser puts in the Referer header when a visitor follows a link or the page loads a resource. Values range from sending the full address to sending nothing at all.
CORS
Cross-Origin Resource Sharing is a set of HTTP headers that lets a server say which other origins are allowed to read its responses from JavaScript. Without those headers the browser fetches the file but refuses to hand the contents to the calling script.
HTTPS
HTTP carried inside an encrypted TLS connection, shown in the browser as an https:// address. It is the same web protocol as before, with the traffic protected and the server's identity checked first.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →