10 Security Headers Every Website Must Have in 2026

A definitive checklist for securing your website using HTTP headers, including modern requirements for CSP, HSTS, and the latest Cross-Origin policies.


The Evolving Landscape of Web Security

As we move into 2026, the complexity of web-based attacks has increased, but so has the power of our defenses. HTTP security headers remain one of the most effective, low-effort/high-impact security measures you can implement.

Below is the updated checklist of the 10 essential security headers every modern website must implement to protect users and maintain trust.

1. Content-Security-Policy (CSP) The gold standard for preventing Cross-Site Scripting (XSS) and data injection attacks. In 2026, a "strict" CSP is no longer optional.

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;

2. Strict-Transport-Security (HSTS) Ensures that all communication with your server is performed over encrypted HTTPS.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

3. X-Content-Type-Options Prevents the browser from "sniffing" the MIME type of a response, which protects against XSS via uploaded files that mimic executable scripts.

X-Content-Type-Options: nosniff

4. X-Frame-Options Protects against clickjacking by preventing your site from being embedded in an iframe on another domain.

X-Frame-Options: DENY

5. Referrer-Policy Controls how much information the browser includes in the `Referer` header when navigators click links away from your site.

Referrer-Policy: strict-origin-when-cross-origin

6. Permissions-Policy Allows you to explicitly enable or disable browser features like the camera, microphone, or geolocation for your site and its iframes.

Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()

7. Cross-Origin-Opener-Policy (COOP) A critical modern header that helps isolate your site's process from other sites, preventing certain types of side-channel attacks like Spectre.

Cross-Origin-Opener-Policy: same-origin

8. Cross-Origin-Embedder-Policy (COEP) Prevents a document from loading any cross-origin resources that don't explicitly grant permission via CORP.

Cross-Origin-Embedder-Policy: require-corp

9. Cross-Origin-Resource-Policy (CORP) Allows you to control which origins can embed your resources, mitigating the risk of cross-site leaks.

Cross-Origin-Resource-Policy: same-origin

10. Expect-CT (Certificate Transparency) While being phased into standard browser behavior, it remains useful for detecting misissued certificates.

Expect-CT: max-age=86400, enforce

How to Audit Your Headers You can use the **ViewPageSource Security Header Checker** to instantly see which headers your site is missing and get detailed implementation advice.

Implementing these headers is often as simple as updating your Nginx, Apache, or Vercel configuration. Don't leave your site vulnerable to preventable attacks!

Hassan is the lead developer and visionary behind ViewPageSource. As a Computer Science student and WordPress specialist with 2 years of experience in custom theme and plugin development, he built this tool to bring transparency to the web. Hassan focuses on creating high-performance, developer-centric applications that help others understand and audit the technology stacks behind their favorite websites.

Ready to optimize your site?

Use our professional tools to analyze your source code and technical SEO health in seconds.