Hardening · 2026-07-21

Security Headers Explained: HSTS, CSP, X-Frame-Options & More

Security headers are small HTTP response headers that tell the browser how to behave more safely — and they're one of the cheapest, highest-leverage hardening steps for any website. This guide explains the headers that matter (HSTS, CSP, X-Frame-Options, Referrer-Policy and friends), what each one does, and how to set them.

See which headers your site is missing: run a free MageArgus scan — it grades your TLS and security headers in seconds.

By the numbers

CSP is the most effective browser defence against injected/skimmer scripts — OWASP
HSTS prevents downgrade and cookie-stealing man-in-the-middle attacks — OWASP

HTTPS first — then HSTS

Everything starts with TLS. Once your whole site is HTTPS, add HSTS to force browsers to always use it:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

This stops downgrade attacks and protects session cookies. Only add preload once you're sure every subdomain is HTTPS.

Content-Security-Policy (CSP)

The big one. CSP restricts which scripts, styles and connections the browser will allow — a strict script-src allow-list stops an injected skimmer from executing at all. Roll it out in report-only mode first, then enforce. See enforcing CSP on Magento.

Clickjacking & MIME protection

X-Frame-Options: SAMEORIGIN            # or use CSP frame-ancestors
X-Content-Type-Options: nosniff        # stop MIME-type sniffing
Referrer-Policy: strict-origin-when-cross-origin

frame-ancestors in CSP is the modern replacement for X-Frame-Options; set both for broad coverage.

Cookie & permission hardening

Cookies: Secure; HttpOnly; SameSite=Lax (or Strict where possible).
Permissions-Policy to disable browser features you don't use (camera, geolocation, etc.).

How to set them

Add headers at the web server or CDN so they apply site-wide:

# nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Then re-scan to confirm they're present and correct.

Frequently asked questions

Which header should I add first?

If you're already on HTTPS, add HSTS and the quick wins (X-Content-Type-Options, Referrer-Policy, X-Frame-Options) immediately — they're low-risk one-liners. Then invest time in CSP, which is the most powerful but needs tuning.

Can security headers break my site?

Most are safe to add directly. CSP is the exception — a too-strict policy can block legitimate scripts, so roll it out in report-only mode, review violations, then enforce. The others rarely cause issues.