The HTTP security headers that actually reduce risk
In short: call
/v1/headers?domain=example.com and check the response for
Strict-Transport-Security, Content-Security-Policy,
X-Content-Type-Options, Referrer-Policy and
Permissions-Policy. A missing header is a finding you can act on today.
Security headers are the cheapest hardening available: a few lines in a reverse proxy configuration that remove entire classes of attack. They are also the most commonly skipped, because nothing breaks visibly when they are absent — which is precisely the problem.
Check what you have today
curl -sI https://example.com | grep -iE
'strict-transport|content-security|x-content-type|referrer-policy|permissions-policy|x-frame'The headers endpoint returns every response header, so you can also capture the whole picture in one call:
curl 'https://freetools.one/v1/headers?domain=example.com' | jq '.[0] | with_entries(select(.key|test("security|policy|frame|transport";"i")))'The checklist
| Header | What it prevents | Priority |
|---|---|---|
Strict-Transport-Security | SSL-strip downgrade attacks | Must have |
Content-Security-Policy | Injected script execution (XSS) | Must have |
X-Content-Type-Options | MIME sniffing turning uploads into script | Must have |
Referrer-Policy | URLs leaking to third parties | Must have |
Permissions-Policy | Abuse of camera, mic, geolocation | Strongly recommended |
X-Frame-Options | Clickjacking via iframes | Use CSP frame-ancestors instead |
Cross-Origin-Opener-Policy | Cross-tab reference attacks | Recommended |
Starting values that work
These are safe defaults for most sites. Tighten them once you understand what breaks.
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; \
style-src 'self' 'unsafe-inline'; script-src 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()Content-Security-Policy without breaking production
CSP is the highest-value header and the easiest to get wrong. Start in report-only mode so violations are logged instead of blocked:
Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-reportCollect violations for a few days, then promote the policy to enforcing. Skipping report-only is the single most common reason teams give up on CSP.
Why X-Frame-Options is the wrong tool now
It only blocks framing from other origins and has no reporting. The CSP directive
frame-ancestors 'none' supersedes it and works consistently across browsers:
Content-Security-Policy: frame-ancestors 'none'Header or certificate first?
Headers are irrelevant on a site whose certificate is broken, and a perfect header set cannot compensate for an expired certificate. Check the TLS certificate first, then the headers — both are one call each.
Frequently asked questions
How do I check if my site has security headers?
Call https://freetools.one/v1/headers?domain=example.com. Every response header is returned as key/value pairs, so you can check for Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and Permissions-Policy in one request.
Which HTTP security headers are most important?
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and Referrer-Policy form the core set. Permissions-Policy and Cross-Origin-Opener-Policy are strong additions. X-Frame-Options is now superseded by the CSP frame-ancestors directive.
How do I add a Content-Security-Policy without breaking my site?
Deploy it first as Content-Security-Policy-Report-Only with a report-uri, collect violations for several days, then promote the same policy to enforcing. Going straight to an enforcing policy is the most common reason teams abandon CSP.
Does HSTS stop SSL stripping?
Yes. Strict-Transport-Security tells browsers to rewrite http:// to https:// for a fixed period, which prevents an attacker on a hostile network from downgrading the connection to plain HTTP.