# Security headers: four settings, in plain words

> What HSTS, a content security policy, nosniff and a referrer policy do, and what to ask your hosting provider to check on your site.

- Web page: https://sporesec.com/en/tools/browser-protections-security-headers
- Language: English
- Last updated: 2026-10-29
- Also in עברית: https://sporesec.com/he/tools/browser-protections-security-headers.md

Checked on 2026-10-29

## What they are

Security headers are short instructions your server sends with each page. Browsers read them and apply extra rules. Setting them is routine hosting work.

## HSTS

HSTS tells the browser to use only HTTPS for your site and to upgrade any later http request. `max-age` is how long the browser remembers it. `includeSubDomains` extends it to subdomains. The optional `preload` flag needs a max-age of at least one year and includeSubDomains, and joins a list built into browsers; that list is run by Google and is not part of the HSTS standard.

## Content Security Policy

A content security policy says which sources a page may load resources from. It helps guard against cross-site scripting: it limits what an injected script can do, and it does not claim to stop all such attacks.

## nosniff

`X-Content-Type-Options: nosniff` tells the browser to trust the declared file type and not guess. For scripts and styles a wrong type is blocked.

## Referrer policy

`Referrer-Policy` controls how much of the page address is sent to other sites when a visitor follows a link. Modern browsers already default to `strict-origin-when-cross-origin`.

## Mixed content

A secure page that loads some parts over plain http is "mixed". Browsers upgrade images, audio and video and block scripts, styles and frames loaded that way.

## What we check

Which of these headers your home page sends, and whether the plain http address moves to https. We say present or missing on the date we read it. This is a read from outside; it is not a security review and not a promise of safety.

## Ask your hosting provider

Does the site redirect http to https? Is HSTS on? Is a content security policy set, and was it tested before it was enforced? Are scripts and images all loaded over https?

## What we do not say

A header you do not have is not proof of a problem, and a full set is not proof of safety.

## Sources

- [MDN, Strict-Transport-Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security) (read on 2026-10-28)
- [MDN, Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy) (read on 2026-10-28)
- [MDN, X-Content-Type-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options) (read on 2026-10-28)
- [MDN, Referrer-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy) (read on 2026-10-28)
- [MDN, Mixed content](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Mixed_content) (read on 2026-10-28)

## Next step

- Run the free website scan: https://sporesec.com/en/tools

---

- Contact: contact@sporesec.com | WhatsApp https://wa.me/972532322318 | https://sporesec.com/en/contact.md
- Book a free intro call: https://sporesec.com/en/book.md
- Machine-readable site data: https://sporesec.com/llms.txt | https://sporesec.com/agents/en/index.json