What security headers should every website send?

Question

A security scanner gave my site an "F" for missing headers. Which headers actually matter and what values should I use?

Accepted Answer

The ones that matter most:

```
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
```

- **HSTS** forces HTTPS on future visits. Start with a short `max-age` and add `preload` only when you're sure every subdomain supports HTTPS.
- **CSP** is the strongest XSS mitigation, and the hardest to get right. Roll it out with `Content-Security-Policy-Report-Only` first, watch the reports, then enforce. Frameworks like Next.js support nonces for inline scripts.
- `frame-ancestors 'none'` in CSP prevents clickjacking (it replaces `X-Frame-Options`).
- **nosniff** stops browsers from guessing MIME types.

Set them in one place (reverse proxy or framework config), and re-test with securityheaders.com or Mozilla Observatory.

1 Repons