---
title: "Security Headers — monitoring glossary"
description: "Security headers are HTTP response headers that instruct browsers to enforce additional defences against common web attacks. Standard set: HSTS, CSP,…"
canonical: "https://lemwatch.com/glossary/security-headers"
source: "https://lemwatch.com"
---

# Security Headers

> Security headers are HTTP response headers that instruct browsers to enforce additional defences against common web attacks. Standard set: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.

## Definition

 Each header addresses a specific attack class. HSTS prevents protocol downgrade. CSP prevents XSS. X-Content-Type-Options stops MIME-type sniffing. X-Frame-Options prevents clickjacking. Referrer-Policy controls leakage of URL paths to third parties. Permissions-Policy locks down access to camera, microphone, geolocation, and other powerful APIs.

 Free audits at securityheaders.com and observatory.mozilla.org grade a site A+ to F based on header presence and configuration. Most production sites score C or worse on first audit — and most can reach A+ with one config change.

## Why it matters

 Security headers are essentially free defence-in-depth. Configuring them takes minutes, costs nothing, and meaningfully reduces the attack surface. They are also a prerequisite for SOC 2, ISO 27001, and most enterprise procurement security reviews.

 See it in the product: [Security headers](https://lemwatch.com/features).


## Related

- [Monitoring glossary](https://lemwatch.com/glossary)
- [CSP](https://lemwatch.com/glossary/csp)
- [HSTS](https://lemwatch.com/glossary/hsts)
- [SSL/TLS](https://lemwatch.com/glossary/ssl)
- [DMARC](https://lemwatch.com/glossary/dmarc)
- [SPF](https://lemwatch.com/glossary/spf)
- [All monitoring checks](https://lemwatch.com/features)
- [SEO (Search Engine Optimization)](https://lemwatch.com/glossary/seo)