Security
Security Headers
Security headers are HTTP response headers that instruct browsers to enforce additional defences against common web attacks. Standard set: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.
Part of Security header monitoring — the full answer, the facts and the alternatives in one place.
In depth
Each header addresses a specific attack class. HSTS prevents protocol downgrade. CSP prevents XSS. X-Content-Type-Options stops MIME-type sniffing. X-Frame-Options prevents clickjacking. Referrer-Policy controls leakage of URL paths to third parties. Permissions-Policy locks down access to camera, microphone, geolocation, and other powerful APIs.
Free audits at securityheaders.com and observatory.mozilla.org grade a site A+ to F based on header presence and configuration. Most production sites score C or worse on first audit — and most can reach A+ with one config change.
Why it matters
Security headers are essentially free defence-in-depth. Configuring them takes minutes, costs nothing, and meaningfully reduces the attack surface. They are also a prerequisite for SOC 2, ISO 27001, and most enterprise procurement security reviews.
How Lemwatch helps with security headers
Lemwatch monitors security headers continuously and alerts you the moment something changes.
Security headers →Related terms
CSP
Content Security Policy (CSP) is an HTTP response header that restricts which sources a browser may load scrip…
HSTS
HTTP Strict Transport Security (HSTS) is an HTTP response header that tells browsers to access the site only o…
SSL/TLS
SSL/TLS is the cryptographic protocol that secures HTTPS connections. It encrypts traffic between browser and …
DMARC
DMARC is an email authentication protocol that lets a domain owner publish a policy specifying how mailbox pro…
SPF
Sender Policy Framework (SPF) is an email authentication standard that publishes the list of IP addresses auth…
Browse the full Lemwatch monitoring glossary (47 terms).