---
title: "Security Headers Explained — Lemwatch Help"
description: "What security headers are, why they matter, and how to fix them."
canonical: "https://lemwatch.com/help/security-headers"
source: "https://lemwatch.com"
---

# Security Headers Explained

> What security headers are, why they matter, and how to fix them.

## Security Headers Explained

 LemWatch checks for essential HTTP security headers on every scan and grades your site A+ through F.

### Key Headers

 Header — Purpose — Impact —

 **Strict-Transport-Security** — Forces HTTPS connections — Prevents downgrade attacks —

 **Content-Security-Policy** — Controls which resources can load — Prevents XSS attacks —

 **X-Frame-Options** — Controls iframe embedding — Prevents clickjacking —

 **X-Content-Type-Options** — Prevents MIME type sniffing — Blocks content-type attacks —

 **Referrer-Policy** — Controls referrer information — Protects user privacy —

 **Permissions-Policy** — Controls browser feature access — Limits API abuse —

### Security Grade

 LemWatch grades from **A+** (all headers correctly configured) to **F** (missing critical headers):

- A+/A — Excellent. All critical headers present and correctly configured

- B — Good. Most headers present, minor improvements possible

- C — Fair. Missing some recommended headers

- D/F — Poor. Missing critical security headers

### How to Fix

 Click any missing header in LemWatch for **stack-specific instructions**:

- Nginx — Add to your server block

- Apache — Add to .htaccess or httpd.conf

- Cloudflare — Use Transform Rules

- Vercel/Netlify — Add to vercel.json or _headers file


## Related

- [Help centre](https://lemwatch.com/help)
- [SSL Certificate Monitoring](https://lemwatch.com/help/ssl-monitoring)
- [Understanding Your Security Grade](https://lemwatch.com/help/security-grade)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [SEO Health Monitoring](https://lemwatch.com/help/seo-monitoring)