Website security headers, explained for business owners

Every time someone opens your website, your server sends a few lines of instructions to their browser before the page itself. These are called headers. Some of them tell the browser how to protect your visitors.

They are invisible to visitors, cost nothing to add, and are one of the first things a security review looks at.

Strict-Transport-Security (HSTS) tells browsers to always use the secure https:// version of your site, even if someone types http://.

Content-Security-Policy limits which scripts and files your pages are allowed to load, which makes many common attacks much harder.

X-Frame-Options or frame-ancestors stops other websites from showing your pages inside a hidden frame to trick your visitors into clicking something.

X-Content-Type-Options and Referrer-Policy are small settings that stop browsers guessing file types and limit what information is passed to other sites.

SPF, DKIM and DMARC are records in your domain settings that help other email services tell real emails from your business apart from fake ones pretending to be you.

A missing or relaxed DMARC record makes it easier for someone to send emails that look like they came from you.

The free Qawex Security Scan checks HTTPS, security headers, cookies and email protection in about 30 seconds. It is passive: it only reads what your site already shows to every visitor.

Each finding explains what is wrong, why it matters and how to fix it, in plain language.