HTTP security headers are one-line server configurations that instruct browsers how to handle your site's content. They prevent a wide range of attacks — from clickjacking to cross-site scripting — without requiring any changes to your application code.
The Six Critical Headers
1. Content-Security-Policy (CSP)
CSP is the most powerful header for preventing XSS attacks. It defines a whitelist of sources from which scripts, styles, images, and other resources can be loaded. A misconfigured CSP blocks legitimate resources; a missing CSP allows any script from any source.
Start with a report-only policy to audit violations before enforcing:
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://cdn.example.com; report-uri /csp-violations2. Strict-Transport-Security (HSTS)
HSTS forces browsers to use HTTPS for all future requests to your domain, even if the user types http://. Without HSTS, an attacker on the same network can downgrade your connection.
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload3. X-Frame-Options / frame-ancestors
Prevents your pages from being embedded in iframes on other sites (clickjacking). The modern CSP frame-ancestors directive replaces the older X-Frame-Options header.
4. X-Content-Type-Options
Stops browsers from MIME-sniffing a response away from the declared content type. One line, maximum protection:
X-Content-Type-Options: nosniff5. Referrer-Policy
Controls how much referrer information is included with outgoing requests. strict-origin-when-cross-origin is the recommended default: it sends the full URL to same-origin requests but only the origin to cross-origin requests.
6. Permissions-Policy
Restricts access to browser APIs (camera, microphone, geolocation) from your pages and embedded third-party content. Even if you don't use these APIs, restricting them prevents third-party scripts from abusing them.
How AISeen Checks Your Headers
AISeen's Security Score audits all six critical headers plus HTTPS configuration, cookie flags, and information leakage (e.g., server version disclosure in response headers). Each missing or misconfigured header deducts points from your score.