What are HTTP security headers?

The short answer

HTTP security headers are response instructions that help browsers apply safer defaults when loading a website.

Step by step

1. Enter a public URL in Headers Checker.
2. Review HSTS, content type, referrer, permissions, and CSP signals in context.
3. Check that the policy matches the resources the site actually needs.
4. Test changes in staging before applying them broadly.

Technical details

• CSP can reduce script injection risk; HSTS requires careful rollout; X-Content-Type-Options prevents MIME sniffing in supported browsers.

Common mistakes

• Copying a restrictive CSP without testing.
• Treating headers as a replacement for input validation.
• Using security headers to conceal a broken application.

Limitations

• A header check observes the response; it does not prove the entire application is secure.