Security headers are small instructions your server sends with every page. They tell the browser what your site is allowed to do, and they cost nothing to add. The OWASP Secure Headers Project and Mozilla's web security guidelines both treat them as table stakes. Most websites still send none of them.

Here are the six that matter, and the attack each one shuts down.

1. Strict-Transport-Security (HSTS)

Tells the browser to only ever talk to your site over HTTPS, even if someone types the plain http:// address or clicks an old link. This closes the window where a network attacker can intercept the first insecure request. One header, one whole attack class gone.

2. Content-Security-Policy (CSP)

A whitelist of where your site is allowed to load scripts, styles and images from. A good CSP contains the damage of a cross-site scripting bug: injected script from an attacker's domain simply refuses to run. It is also the hardest header to get right, which is why it deserves a careful, report-only rollout rather than a copy-paste value.

3. X-Frame-Options

Stops other sites from embedding your pages in an invisible iframe and tricking visitors into clicking things they cannot see. That attack is called clickjacking, and this one line ends it: X-Frame-Options: SAMEORIGIN.

4. X-Content-Type-Options

One fixed value, nosniff. It stops the browser from guessing file types, which prevents a class of attacks where an uploaded file that claims to be an image gets executed as script.

5. Referrer-Policy

Controls how much of your URL travels along when a visitor clicks an outbound link. Without it, third-party sites can see full paths and query strings, which sometimes contain tokens or private identifiers. strict-origin-when-cross-origin is the sensible default.

6. Permissions-Policy

Declares which browser features your site actually uses: camera, microphone, geolocation, and so on. Turning off what you do not use limits what any injected script could ever ask for.

How to check your own site

You can see your headers in one command:

curl -sI https://yourdomain.com | grep -iE 'strict|content-security|frame|referrer|permissions'

Or run a free AuditMerlin scan: it checks all six, tells you which are missing, and links every finding to the OWASP or Mozilla guideline behind it. If your site runs behind Cloudflare, most of these headers can be added in minutes without touching your server.