Security headers: four settings, in plain words

What HSTS, a content security policy, nosniff and a referrer policy do, and what to ask your hosting provider to check on your site.

Run the free website scan

Checked on 2026-10-29

What they are

Security headers are short instructions your server sends with each page. Browsers read them and apply extra rules. Setting them is routine hosting work.

HSTS

HSTS tells the browser to use only HTTPS for your site and to upgrade any later http request. max-age is how long the browser remembers it. includeSubDomains extends it to subdomains. The optional preload flag needs a max-age of at least one year and includeSubDomains, and joins a list built into browsers; that list is run by Google and is not part of the HSTS standard.

Content Security Policy

A content security policy says which sources a page may load resources from. It helps guard against cross-site scripting: it limits what an injected script can do, and it does not claim to stop all such attacks.

nosniff

X-Content-Type-Options: nosniff tells the browser to trust the declared file type and not guess. For scripts and styles a wrong type is blocked.

Referrer policy

Referrer-Policy controls how much of the page address is sent to other sites when a visitor follows a link. Modern browsers already default to strict-origin-when-cross-origin.

Mixed content

A secure page that loads some parts over plain http is "mixed". Browsers upgrade images, audio and video and block scripts, styles and frames loaded that way.

What we check

Which of these headers your home page sends, and whether the plain http address moves to https. We say present or missing on the date we read it. This is a read from outside; it is not a security review and not a promise of safety.

Ask your hosting provider

Does the site redirect http to https? Is HSTS on? Is a content security policy set, and was it tested before it was enforced? Are scripts and images all loaded over https?

What we do not say

A header you do not have is not proof of a problem, and a full set is not proof of safety.

Sources

MDN, Strict-Transport-Security (read on 2026-10-28)
MDN, Content-Security-Policy (read on 2026-10-28)
MDN, X-Content-Type-Options (read on 2026-10-28)
MDN, Referrer-Policy (read on 2026-10-28)
MDN, Mixed content (read on 2026-10-28)

Want us to read your own site? Run the free website scan, or book a free call.

We build it. We look after it.

Free, 30 minutes, no sales deck. We ask about the problem, the goal, and what has been tried. If we fit, you get a fixed-price proposal.