SwitchPDF
All articles
Security August 12, 2026 5 min read

Reading a Website's Security Headers (And What to Fix First)

Six HTTP headers do most of the browser-side security work. Here is what each one stops, and the order worth fixing them in.

Security headers are instructions your server sends telling the browser how to behave. They cost nothing to add and they close entire categories of attack. Most sites ship two of the six.

The six that matter

Strict-Transport-Security (HSTS) — tells the browser "always use HTTPS for this domain, for the next N seconds." Without it, a visitor's first request can still go out over plain HTTP and be intercepted. A sane value:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Content-Security-Policy (CSP) — the big one. It lists which sources are allowed to load scripts, styles, frames and images. It is the main defence against injected scripts, and it's the header most often missing.

X-Content-Type-Options: nosniff — stops the browser from guessing a file's type. Without it, a user-uploaded file the server calls text/plain can be executed as JavaScript.

X-Frame-Options — stops your pages being embedded in someone else's iframe, which is how clickjacking works. If your CSP already sets frame-ancestors, that supersedes this one and you don't need both.

Referrer-Policy — controls how much of your URL is leaked to sites you link out to. Matters if your URLs contain tokens or IDs.

Permissions-Policy — switches off browser features you don't use: camera, microphone, geolocation.

Fix them in this order

  1. HTTPS everywhere, then HSTS. Everything else is decoration if traffic isn't encrypted.
  2. nosniff — one line, no risk of breaking anything.
  3. X-Frame-Options or CSP frame-ancestors — also one line, also near-zero risk.
  4. Referrer-Policy — strict-origin-when-cross-origin is a good default.
  5. CSP — most work, most benefit. Deploy it in Content-Security-Policy-Report-Only mode first and watch what it would have blocked for a week.
  6. Permissions-Policy — nice to have.

Check yours in a few seconds

Paste your URL into SwitchPDF Website Analyzer. It reports every one of the six with its actual value, grades the result, and knows that a CSP with frame-ancestors makes X-Frame-Options redundant — so a modern setup isn't penalised for skipping a legacy header.

It also flags a related mistake: an X-Powered-By header advertising your exact framework and version. That's free reconnaissance for anyone scanning for known vulnerabilities. Remove it.

The one that isn't a header

While you're in there, check your certificate expiry. An expired certificate takes a site fully offline for every visitor, and it happens to people who assumed auto-renewal was working. The analyzer reports days remaining.

Bottom line

Four of the six are one-line additions with essentially no risk. Do those this afternoon, then take your time with CSP. Going from an F to a B is roughly fifteen minutes of work.

Related articles