Add basic HTTP security headers

The problem

The homepage response is missing recommended security headers.

How to spot it

The audit lists the missing headers. You can also see the response headers in your browser's network tab.

Why it matters

These headers tell browsers to always use HTTPS, not to guess file types, and not to let other sites frame your pages (clickjacking).

What happens if you leave it

Visitors are more exposed to downgrade attacks and clickjacking.

How to fix it

1. Add the headers at the web server or CDN. Nginx example:

   add_header X-Content-Type-Options "nosniff" always;
   add_header X-Frame-Options "SAMEORIGIN" always;
   add_header Referrer-Policy "strict-origin-when-cross-origin" always;
   add_header Strict-Transport-Security "max-age=31536000" always;
   

2. HSTS caution: only send Strict-Transport-Security once HTTPS works on the whole domain. Start with a short max-age (for example one day) and increase it. Add includeSubDomains only if every subdomain supports HTTPS.

3. Content-Security-Policy gives the strongest protection but needs care, because a strict policy can break third-party scripts. Start with Content-Security-Policy-Report-Only to see what would be blocked.

Common mistakes

• Enabling long-lived HSTS before HTTPS works everywhere.
• Copying a strict CSP that breaks analytics, chat widgets or payments.

How to check the fix worked

Check the response headers with your browser or curl -I https://www.example.com/. Re-run the audit.