ON. WebMeter

Website security headers

A few lines in the server's response tell the browser what the page may load and how it should behave. They are cheap to set up and protect your visitors.

Updated

What security headers are

With every page, the server sends HTTP headers. Some of them switch on protections right in the browser:

  • Content-Security-Policy (CSP) defines where the page may load scripts, styles and other resources from. It limits the damage if foreign code gets into the page.
  • Strict-Transport-Security (HSTS) tells the browser to open the website over HTTPS only. The recommended lifetime is at least a year (max-age=31536000).
  • X-Frame-Options or CSP frame-ancestors prevent your website from being embedded in someone else's page to trick visitors into clicking.
  • X-Content-Type-Options: nosniff stops the browser from guessing file types.
  • Referrer-Policy controls how much of the page address is passed to other websites; strict-origin-when-cross-origin is a sensible choice.
  • Permissions-Policy switches off features the website doesn't need, such as the camera, microphone or location.

Add to that a security.txt file at /.well-known/security.txt (RFC 9116) with a contact for reporting security issues and an expiry date.

Why it matters for a small business

Small websites often run on a CMS with many plugins, and if one of them is vulnerable, headers limit what an attacker can do to your visitors. Missing headers are also visible to anyone vetting your website, such as a client running a tender or an insurer.

Common security header mistakes

  • A CSP with 'unsafe-inline' and 'unsafe-eval' for scripts, or just upgrade-insecure-requests, which does not restrict scripts.
  • HSTS with a lifetime of a few minutes or days.
  • X-Frame-Options in a meta tag, where the browser ignores this protection.
  • Server or X-Powered-By headers revealing the exact software version.
  • A security.txt file with an expired Expires date.

What WebMeter checks, and what it doesn't

WebMeter reads the headers the server sends with your homepage: CSP, HSTS, framing protection, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It also assesses cookie attributes, SRI on scripts from other domains, CORS, revealed software versions and the security.txt file. For comparison, it estimates the Mozilla Observatory and securityheaders.com grades.

It assesses only the homepage, not APIs or other parts of the website, and tests nothing. Good headers do not fix bugs in the application or outdated software.

Check your website for free

Enter your domain to see which headers your website sends, along with the other areas of your website.

Check website

Not sure what to make of the results? We offer a no-obligation consultation, just write to kontakt@webmeter.eu.

FAQ about security headers

Can headers break my website?

Yes, especially CSP, and the includeSubDomains option of HSTS. That is why they should be introduced carefully and step by step, so they don't block scripts you need or access over HTTPS.

What is security.txt, and does a small business need it?

A text file at /.well-known/security.txt (RFC 9116) with a contact for reporting security issues and an expiry date. It costs nothing, and anyone who finds a flaw on your website knows whom to tell.

Does a good header grade mean the website is safe?

No. Headers are one layer of protection in the visitor's browser. They do not fix bugs in the application, an outdated CMS or weak passwords. A good grade only means this layer is in place.