Security Headers Explained

What security headers are, why they matter, and how to fix them.

Security Headers Explained

LemWatch checks for essential HTTP security headers on every scan and grades your site A+ through F.

Key Headers

Header — Purpose — Impact —

Strict-Transport-Security — Forces HTTPS connections — Prevents downgrade attacks —

Content-Security-Policy — Controls which resources can load — Prevents XSS attacks —

X-Frame-Options — Controls iframe embedding — Prevents clickjacking —

X-Content-Type-Options — Prevents MIME type sniffing — Blocks content-type attacks —

Referrer-Policy — Controls referrer information — Protects user privacy —

Permissions-Policy — Controls browser feature access — Limits API abuse —

Security Grade

LemWatch grades from A+ (all headers correctly configured) to F (missing critical headers):

• A+/A — Excellent. All critical headers present and correctly configured
• B — Good. Most headers present, minor improvements possible
• C — Fair. Missing some recommended headers
• D/F — Poor. Missing critical security headers

How to Fix

Click any missing header in LemWatch for stack-specific instructions:

• Nginx — Add to your server block
• Apache — Add to .htaccess or httpd.conf
• Cloudflare — Use Transform Rules
• Vercel/Netlify — Add to vercel.json or _headers file