How to Add Security Headers - HSTS, CSP & More

🧱Free Security Headers Checker
Grade a website's HTTP security headers from A+ to F.Open tool →

Check your grade first

Run your domain through the Security Headers Checker to see which headers are missing and the exact value to add for each.

The safe starter set

Strict-Transport-Security: max-age=31536000; includeSubDomains. X-Content-Type-Options: nosniff. X-Frame-Options: SAMEORIGIN. Referrer-Policy: strict-origin-when-cross-origin. Permissions-Policy: camera=(), microphone=(), geolocation=() (allow features your site uses).

Where to add them

Cloudflare: Rules > Transform Rules > Modify response header. Apache/.htaccess: Header always set Name "value". Nginx: add_header Name "value" always;. WordPress: a security or headers plugin if you can't edit server config.

Content-Security-Policy last

CSP is the most powerful header but can break scripts. Start with Content-Security-Policy-Report-Only, review what it would block, then enforce.

Frequently asked questions

Will HSTS break my site?

Only if parts of it don't work over HTTPS – fix those first.

Do headers affect SEO?

Not directly, but HTTPS and site safety do.

How long does it take?

Usually under 30 minutes.