Security Headers: The Invisible Settings Protecting Your Website

You can't see security headers. They don't appear on the page, they don't affect how your site looks, and no visitor will ever notice they're there. That's exactly why so few small business websites have them set up properly - nobody's asking for them, so nobody's building them.

Security headers are instructions your web server sends to every visitor's browser, invisibly, before a single image or line of text loads. They tell the browser things like "only load scripts from this domain" or "never let this page be displayed inside a frame on another site." The browser follows those instructions without the visitor ever knowing they existed.

Here's what the main ones actually protect against.

Clickjacking

Without the right header in place, another website can load your site inside an invisible frame and trick visitors into clicking buttons they think belong to that other site but are actually yours - transferring money, submitting a form, or granting a permission without realising it. A header called X-Frame-Options (or its modern replacement, frame-ancestors) simply tells browsers "don't allow my site to be framed like this," and the attack becomes impossible.

Malicious scripts running on your site

If your website has any way for user-submitted content to reach the page (a comment box, a search field, a form that echoes back what someone typed) there's a risk of an attacker sneaking in a script that runs in your visitors' browsers. This could steal login details, redirect people to a scam page, or quietly harvest data. A Content Security Policy header tells the browser exactly which sources of scripts, images and fonts are allowed to run on your page and blocks everything else. It's one of the more involved headers to set up properly, but it closes off a genuinely serious attack route.

Being tricked into using an insecure connection

Most sites now run over HTTPS, the padlock-in-the-address-bar version of the web. But if someone types your address without the "https" or clicks an old link that points to the insecure version, there's a brief window where an attacker on the same network (a coffee shop wifi, for instance) could intercept that connection. A header called HSTS tells the browser "never connect to this site over anything other than HTTPS, ever, even if a link says otherwise." Once a browser has seen it, it enforces that rule for future visits automatically.

Leaking more than you mean to

Every time someone clicks a link from your site to another one, their browser can tell the destination site exactly which page they came from, including anything sensitive in the web address itself. A Referrer-Policy header limits how much of that information gets passed along, which matters more than people assume if your site has any pages with account details, order references or personal data in the URL.

Why this matters for a business that isn't a bank

It's easy to assume this kind of thing only matters for sites handling payments or sensitive data. In reality, any website with a login, a contact form, or a way for customers to submit information is worth targeting, not because your business is a specific target, but because automated tools scan the entire web looking for sites without basic protections in place. Being an easy, unprotected target is often the only qualification an attacker needs.

There's also a quieter reason to care: search engines and browsers increasingly treat security signals as part of how trustworthy a site appears, and browsers will actively warn visitors away from sites they consider unsafe. A badly configured site can end up flagged before a customer even reaches your homepage.

Checking where you stand

You don't need to understand any of this in depth to find out whether your site has these protections. Free tools exist that scan any public website and report back which security headers are present, missing, or misconfigured, giving you a plain list rather than a technical report. If you run one of these checks and come back with a page of red crosses, that's not a sign your site has been built badly overall. It's simply a sign that whoever built it didn't set this particular, invisible layer up, which is extremely common and usually a quick fix for anyone who knows where to add it.

It costs nothing to check, and fixing what comes back rarely takes long. For something that quietly protects every visitor to your site without them ever knowing it's there, it's one of the easiest wins available.