What Security Headers Actually Tell You

Security headers are HTTP response directives that change browser behaviour. They are one layer of a defense-in-depth strategy — useful, but not sufficient on their own.

The headers that matter most

Strict-Transport-Security (HSTS)

Tells the browser to only use HTTPS for this host for max-age seconds. Prevents downgrade attacks once the user has visited the site once.

What a missing HSTS header does not mean: the site is insecure. It might just not be eligible (HSTS requires HTTPS and a stable max-age commitment).

Content-Security-Policy (CSP)

Tells the browser which origins scripts, styles, images and frames can come from. A strict CSP is one of the best mitigations for XSS.

What a present CSP header does not mean: the site is safe. A CSP containing unsafe-inline or unsafe-eval can be nearly useless, and a permissive default-src * is only slightly better than no CSP at all.

X-Frame-Options / frame-ancestors

Prevents the page from being embedded in an iframe from another origin. Modern sites should prefer the CSP frame-ancestors directive; X-Frame-Options is the legacy fallback.

How to read a report

Ask three questions per header:

1. Is it present?
2. Is the value reasonable for this site's threat model?
3. Does its presence contradict anything else you can see? (A site with HSTS but mixed-content warnings is telling you something.)