Security headers for small business websites: what they do and which matter

Published October 27, 2026

Security headers are short instructions that a web server sends along with every page, telling the visitor's browser to apply extra protections. They are cheap to add and they shut down several common kinds of attack. They are not a substitute for updating your software, but a site without them is missing easy protection.

The headers that matter most

• Strict-Transport-Security (HSTS). Tells the browser to use only HTTPS for your site for a set time, so a visitor cannot be tricked onto an unencrypted copy. Make sure HTTPS works everywhere first, and start with a short lifetime.
• Content-Security-Policy. Lists where a page may load scripts, styles and images from. It limits the damage if an attacker manages to inject code. It is also the hardest to get right, because a policy that is too strict breaks the site.
• X-Frame-Options (or the frame-ancestors part of a Content-Security-Policy). Stops other sites from showing your pages inside a frame, which is how clickjacking works.
• X-Content-Type-Options: nosniff. Stops browsers from guessing a file's type, which can turn an uploaded file into something that runs.
• Referrer-Policy. Controls how much of your address is sent to other sites when someone follows a link away from yours.
• Permissions-Policy. Turns off browser features your site does not use, such as the camera, microphone and location.

Cookie settings belong with them

If your site sets cookies for sign-in, add the Secure, HttpOnly and SameSite flags. They keep the cookie off unencrypted connections, out of reach of scripts, and from being sent along with requests from other sites.

Where to set them

It depends on how your site is hosted: in the web server's configuration, in your hosting control panel, in a content delivery network such as Cloudflare through its rules for response headers, or through a plugin if you use a content management system. Your web developer or hosting provider can usually add them in minutes.

How to roll them out safely

1. Test on a copy of the site first, where you can.
2. Add them one at a time and check that the site still works, including forms, payments and embedded content.
3. For Content-Security-Policy, begin in report-only mode, which reports what would have been blocked without blocking it.
4. For HSTS, begin with a short lifetime, and extend it once you are sure nothing breaks. Be careful with the option that applies it to every subdomain, since it affects all of them.
5. Check again after any change to the site or its hosting.

What they do not do

Headers make some attacks harder. They do not fix vulnerable code or an outdated plugin, and a good score on a header checker does not mean a site is secure. Treat them as one layer next to patching, strong sign-in and monitoring.

How Frontage helps

Frontage's web checks look at the security headers on the domains you have authorized, report the ones that are missing or weak, and explain how to fix each. A scheduled scan tells you if a change to your site quietly removes one.