HTTP Security Headers: A Practical Guide
Security headers are instructions your server sends to every browser that visits your site, telling it to enforce rules that block whole classes of common attacks. This guide covers the six headers Nivaronix's security headers checker evaluates, plus the one deprecated header it flags for removal.
Last updated August 9, 2026.
Why headers instead of code changes
Most web security fixes require changing application logic. Security headers are different: they are declarative instructions enforced by the browser itself, so a single line in your server or CDN configuration changes behavior for every visitor, on every page, with no application code touched. That's why they're usually the fastest fix available on a scan report.
The headers, at a glance
Strict-Transport-Security Medium severity
Tells browsers to only ever connect to your site over HTTPS, for a set period of time, without waiting for a redirect.
Read the HSTS guide →Content-Security-Policy Medium severity
Declares which sources a page is allowed to load scripts, styles, images and other resources from, restricting what injected content can do.
Read the CSP guide →X-Frame-Options Medium severity
Controls whether your pages can be loaded inside an `<iframe>` on another site, which is the mechanism behind clickjacking.
Read the X-Frame-Options guide →X-Content-Type-Options Low severity
Stops the browser from guessing a file's content type instead of trusting the server's declared Content-Type.
Read the X-Content-Type-Options guide →Referrer-Policy Low severity
Controls how much of your page's URL is sent in the Referer header when a user clicks a link away from it.
Read the Referrer-Policy guide →Permissions-Policy Low severity
Lets you switch off or restrict powerful browser APIs — camera, microphone, geolocation and more — for your own pages and any embedded content.
Read the Permissions-Policy guide →X-XSS-Protection Deprecated
A legacy header that toggled an old browser-side reflected-XSS filter. The filter it controlled has been removed from every current major browser engine, so the header itself now does nothing but should still be removed.
Read about the deprecated X-XSS-Protection finding →What Nivaronix checks
Nivaronix's security headers checker inspects the response from your site and records whether each of the headers above is present and how it's configured. It is a security misconfiguration check — it does not attempt to exploit anything, and it is not a penetration test or vulnerability scanner.
See the full checker page for details on severities and evidence, or run a scan on your own domain. For the exact scoring and severity rules applied to headers findings, see the methodology page.