---
title: "Security Headers"
description: "HTTP security headers protect sites from XSS, clickjacking and downgrade attacks. Learn what CSP, HSTS and X-Frame-Options do and how to deploy them."
url: "https://nodea.io/en/glossary/security-headers"
lang: "en"
updated: "2026-07-13"
---

# Security Headers

> Security headers are HTTP response directives that instruct the browser to apply extra protections. They limit the impact of common web attacks such as XSS and clickjacking.

**Security headers** are special [HTTP](https://nodea.io/en/glossary/http) response headers with which a server tells the browser how to treat a page's content from a security standpoint. Instead of relying solely on application code, they push part of the protection down to the browser level, mitigating common web attacks — many of them catalogued by the [OWASP](https://nodea.io/en/glossary/owasp) project.

## How security headers work

The server attaches these headers to each response, and the browser enforces the rules they contain. The most important ones include:

- **Content-Security-Policy (CSP)** — defines which sources scripts, styles and other assets may load from, effectively limiting [XSS](https://nodea.io/en/glossary/xss) attacks.
- **Strict-Transport-Security ([HSTS](https://nodea.io/en/glossary/hsts))** — forces connections over [HTTPS](https://nodea.io/en/glossary/https) and blocks attempts to reach the site over unencrypted HTTP.
- **X-Frame-Options** — prevents the page from being embedded in an \<iframe\>, protecting against clickjacking.
- **X-Content-Type-Options: nosniff** — stops the browser from guessing a file's MIME type.
- **Referrer-Policy** and **Permissions-Policy** — control referrer leakage and access to device features such as camera or location.

## Practical application

Security headers are configured on the web server — in Apache via the [.htaccess](https://nodea.io/en/glossary/htaccess) file or *Header set* directives, in Nginx inside the server block with the *add\_header* directive. On shared hosting, basic headers such as HSTS are often available in the control panel with a single click once an SSL certificate is enabled.

It is worth verifying the deployment with online scanners that grade a site's header set and highlight gaps. CSP demands particular care — an overly strict policy can block the site's own scripts, so it is rolled out gradually, first in report-only mode. When configured correctly, security headers are one of the cheapest ways to meaningfully raise a website's resilience to attacks.

### Do security headers replace other protections?

No. Security headers are a browser-side layer of defense that limits the impact of vulnerabilities, but they do not remove the root cause. You still need input validation, up-to-date software, a web application firewall and encryption. Headers complement these mechanisms rather than substituting for them.

## Related

- [HSTS (HTTP Strict Transport Security)](https://nodea.io/en/glossary/hsts)
- [HTTPS](https://nodea.io/en/glossary/https)
- [XSS](https://nodea.io/en/glossary/xss)
- [CSRF (Cross-Site Request Forgery)](https://nodea.io/en/glossary/csrf-cross-site-request-forgery)
- [OWASP](https://nodea.io/en/glossary/owasp)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/nagowki-bezpieczenstwa.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)