Security headers are HTTP response headers that instruct browsers to enforce additional defences against common web attacks. Standard set: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.
Each header addresses a specific attack class. HSTS prevents protocol downgrade. CSP prevents XSS. X-Content-Type-Options stops MIME-type sniffing. X-Frame-Options prevents clickjacking. Referrer-Policy controls leakage of URL paths to third parties. Permissions-Policy locks down access to camera, microphone, geolocation, and other powerful APIs.
Free audits at securityheaders.com and observatory.mozilla.org grade a site A+ to F based on header presence and configuration. Most production sites score C or worse on first audit — and most can reach A+ with one config change.
Security headers are essentially free defence-in-depth. Configuring them takes minutes, costs nothing, and meaningfully reduces the attack surface. They are also a prerequisite for SOC 2, ISO 27001, and most enterprise procurement security reviews.
See it in the product: Security headers.