Security Headers

Security headers are HTTP response headers that your web server sends along to a visitor's browser. They contain instructions on how the browser should interact with your website content to prevent attacks such as cross-site scripting(XSS), clickjacking and man-in-the-middle attacks. In practice, they work as a set of security rules that you activate at server level, without having to modify your website code. For SMEs with an online shop, customer portal or WordPress site, security headers are one of the most effective and approachable ways to increase security.

How security headers work on a technical level

Every time a browser requests a page from your website, your web server sends back an HTTP response. That response consists of the visible content (HTML, CSS, images) plus a series of headers with metadata. Security headers are specific instructions within that metadata. For example, a header like Content-Security-Policy tells the browser which scripts, images and style sheets it may or may not load. X-Frame-Options blocks your site from loading into an iframe on another website, preventing clickjacking. Strict-Transport-Security enforces HTTPS even if a user accidentally follows an HTTP link. These headers are interpreted by modern browsers and thus work without visitors noticing.

Why security headers came into being and why they are crucial now

Security headers were developed from the early 2000s in response to large-scale attacks in which malicious actors exploited the way browsers handled external content. Cross-site scripting, where attackers inject scripts into your site, was one of the most common vulnerabilities. Browsers initially executed any code they encountered, without looking critically at the source. With the introduction of headers such as Content-Security-Policy and X-XSS-Protection, website owners were for the first time given the ability to limit that default behaviour. According to the W3C Content Security Policy Level 3 specification, these headers are now part of the web standard. In practice, websites without security headers are more vulnerable to data theft, phishing and reputation damage.

What security headers bring to SME companies

Voor een Nederlandse webshop of dienstverlener met een klantportaal betekenen security headers een directe verlaging van het risico op datalekken en aanvallen. Een webshop die persoonsgegevens en betaalgegevens verwerkt, moet voldoen aan de AVG-verplichtingen rond beveiliging. Security headers zijn een van de technische maatregelen die je kunt aantonen bij een audit. Daarnaast waarderen zoekmachines zoals Google sites met een sterke beveiligingsconfiguratie hoger, omdat ze veiliger zijn voor gebruikers. Bij een goed geconfigureerde WordPress hosting-omgeving worden security headers standaard ingesteld op serverniveau, waardoor je als ondernemer niet zelf met .htaccess-bestanden hoeft te werken. Het resultaat is een site die beter beschermd is tegen aanvallen, zonder dat je snelheid of gebruiksvriendelijkheid inlevert.

Security headers are not just for large platforms or banks. An SME online shop with 500 products or a B2B service provider with a customer portal also benefit directly from this technology. Below you can read where to deploy security headers in practice and which headers are most relevant for Dutch companies.

Protection against cross-site scripting in online shops and forms

Cross-site scripting (XSS) is an attack where a hacker injects malicious scripts into your website, for example via a non-well-protected contact form or product review field. Those scripts can steal login details or redirect visitors to phishing pages. The Content-Security-Policy (CSP) header prevents this by telling the browser which scripts it can run. For example, you can set that only scripts from your own domain and from Google Analytics are allowed to run. For an online shop on WooCommerce or Shopify, this means that your forms and checkout flows are better protected. In practice, we find in online shop development projects that a strict CSP sometimes conflicts with external plugins or tracking scripts. Therefore, set your CSP in report-only mode during the testing phase, so you can see which scripts are blocked without breaking your site.

Preventing clickjacking in customer portals and login pages

Clickjacking is an attack technique where a hacker loads your login page into an invisible iframe on another site. Visitors think they are logging into your site, but in reality click on buttons placed by the attacker. The X-Frame-Options header prevents this by prohibiting browsers from loading your pages in an iframe. For an SME company with a customer portal, online billing environment or B2B platform, this is essential. You set X-Frame-Options to DENY (no iframes at all) or SAMEORIGIN (only iframes from your own domain). An alternative is the frame-ancestors-directive within Content-Security-Policy, which offers more flexibility. In a well-secured web development environment, these headers are included by default, so your login pages cannot be abused.

Enforcing HTTPS connections with Strict Transport Security

Strict-Transport-Security (HSTS) is a header that forces browsers to communicate with your site only via HTTPS, even if a user accidentally follows an HTTP link. This prevents man-in-the-middle attacks where an attacker places himself between the user and your server to intercept data. For an online shop or service provider that processes personal data, HSTS is a hard requirement from the Personal Data Authority. You set HSTS with a max-age value (e.g. one year) and optionally the includeSubDomains-directive if you also want to protect subdomains. Note: HSTS is irreversible for the duration of the max-age period. If you disable HTTPS later, visitors will no longer be able to reach your site. Therefore, test with a short max-age value first before permanently activating the header.

When security headers are the right choice and when they are not

Security headers almost always make sense, but configuration varies from situation to situation. For a static website without forms or login functionality, basic headers such as X-Content-Type-Options and Referrer-Policy suffice. For an online shop or customer portal, you need a strict Content-Security-Policy and HSTS. Security headers are no substitute for other security measures such as regular updates, strong passwords and two-factor authentication. They work best as part of a broader security strategy. If your site depends on a lot of external scripts (ad networks, chatbots, A/B testing tools), too strict CSP can cause functionality to fail. In that case, set CSP gradually and monitor console errors in your browser to see which sources are being blocked.