How to Configure HTTP Security Headers on Your Web Server

HTTP security headers are server responses that tell the browser how to handle your site before loading any page — what content it can execute, whether your pages can be embedded in iframes, what referrer information to share with external links, and more. Adding them correctly closes entire classes of vulnerabilities without touching a single line of your application code.

This article covers the six most important headers, what each one protects against, and how to set them up on Apache and Nginx.

Why HTTP Security Headers Matter

A site can have perfectly audited code and still be vulnerable if the browser receives no instructions about what's allowed. Cross-Site Scripting (XSS), clickjacking, and referrer-based information leakage all exploit that gap.

Adding the right headers is one of the highest-return security steps you can take: a few minutes of configuration eliminates entire attack categories. Tools like securityheaders.com grade your site from A to F and show exactly what's missing.

The 6 Essential Headers to Configure

1. Content-Security-Policy (CSP)

The most powerful header — and the most complex. It tells the browser which domains may supply scripts, styles, images, and fonts. A strict policy blocks injected scripts at the browser level, shutting down XSS even if an attacker manages to inject malicious markup.

A conservative starter policy:

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;

Tip: deploy in Content-Security-Policy-Report-Only mode first to catch breakage before enforcing it in production.

2. Strict-Transport-Security (HSTS)

Forces the browser to connect via HTTPS for the duration you specify. Eliminates SSL stripping attacks, where a network-level attacker downgrades your connection to plain HTTP. You can read more about SSL fundamentals in our SSL security articles.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

3. X-Frame-Options

Prevents your site from being embedded in an <iframe> on another domain. This stops clickjacking: attacks where users think they're clicking your interface but are actually interacting with invisible malicious overlays.

X-Frame-Options: SAMEORIGIN

4. X-Content-Type-Options

Stops the browser from guessing the MIME type of a resource when the server has already declared it. Without this header, an attacker could upload a text file containing JavaScript and get some browsers to execute it.

X-Content-Type-Options: nosniff

5. Referrer-Policy

Controls what URL information is passed to external destinations when a user clicks a link. Without it, third-party sites can see your full page URLs, including private paths or query parameters carrying sensitive data.

Referrer-Policy: strict-origin-when-cross-origin

6. Permissions-Policy

Formerly Feature-Policy. Restricts which browser APIs your site and its iframes can use — camera, microphone, geolocation, etc. Useful for limiting the blast radius if a third-party script is ever compromised.

Permissions-Policy: geolocation=(), microphone=(), camera=()

How to Add Headers in Apache

Apache requires the mod_headers module to be enabled. Add the directives to your .htaccess file or your <VirtualHost> block:

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
</IfModule>

After saving, reload Apache through your hosting control panel or VPS terminal.

How to Add Headers in Nginx

In Nginx, add the lines inside the server or location block in your site configuration file:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;" always;

Reload Nginx with nginx -s reload and verify with curl -I https://yourdomain.com that headers appear in the response.

Header Comparison Table

Key takeaways

• HTTP security headers are configured at the server level and apply automatically to every page on your site.
• Content-Security-Policy is the most powerful: it blocks XSS but requires careful testing in Report-Only mode first.
• HSTS, X-Frame-Options, and X-Content-Type-Options have minimal compatibility impact and should be enabled right away.
• The logic is the same in Apache and Nginx; only the directive syntax differs (Header always set vs add_header).
• Validate the result on securityheaders.com to confirm everything is in place.

Want a technical team to configure and audit your site's security headers? elenlace.com provides professional web security reviews and ongoing maintenance so your online presence stays protected.

FAQ

Can I set security headers from cPanel or Plesk?

Yes. In cPanel, edit the .htaccess file through the File Manager or the "Modify HTTP Headers" section. Plesk has an equivalent option under each domain's settings. Apache syntax applies in both environments.

Do security headers affect site performance?

Not noticeably. They are a few lines of text the server appends to each HTTP response. The impact on latency or bandwidth is negligible compared to the security benefit they provide.

What if Content-Security-Policy blocks legitimate resources on my site?

External scripts, styles, or fonts may stop loading. That's why you should start with Content-Security-Policy-Report-Only: it logs blocks in the browser console without enforcing them, letting you refine the policy before switching to strict mode.

How often should I review my security headers?

At least every six months, or whenever you add a new external service (analytics, live chat, maps) that loads scripts or styles from a different domain. Those sources must be listed in your CSP policy for the site to continue working correctly.

Prefer it done for you? El Enlace handles hosting and professional web development.

Useful resources

Other providers and guides worth comparing:

• Hostinger
• HubSpot
• IONOS