Five HTTP Headers Every Small Business Website Should Set (And None of Them Cost Anything)

The most common finding we see

Across Security Score scans, missing HTTP security headers are consistently the top finding — more common than outdated libraries, weak TLS, or anything else. The good news: they cost nothing, take minutes to add, and meaningfully reduce several common attack classes.

The five headers

Strict-Transport-Security (HSTS) — tells browsers to always use HTTPS for your domain, even if someone types http://. Prevents downgrade attacks on public wifi.

Content-Security-Policy (CSP) — restricts which sources a page is allowed to load scripts/styles/images from. The single strongest defence against cross-site scripting, though it takes the most tuning to get right without breaking your own site.

X-Frame-Options — stops your site being loaded inside an <iframe> on someone else's page, which blocks "clickjacking" attacks that trick users into clicking something disguised as your UI.

X-Content-Type-Options — set to nosniff, this stops browsers guessing (and misinterpreting) file types in a way attackers can exploit.

Referrer-Policy — controls how much of your URL gets leaked to other sites when a user clicks a link away from you, which matters more than people expect if any of your URLs contain sensitive query parameters.

If you're running Next.js

// next.config.js
module.exports = {
  async headers() {
    return [
      {
        source: "/:path*",
        headers: [
          { key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains; preload" },
          { key: "X-Frame-Options", value: "DENY" },
          { key: "X-Content-Type-Options", value: "nosniff" },
          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
          { key: "Content-Security-Policy", value: "default-src 'self'" },
        ],
      },
    ];
  },
};

Adjust the CSP default-src to actually match what your site loads — a too-strict policy silently breaks pages rather than erroring loudly, so test after changing it.

Not sure which of these your own site is missing? Run a free Security Score scan and it'll tell you in about a minute.