HTTP Security Headers: How to Configure Them (Step by Step)

Introduction

HTTP security headers are instructions your server sends to the browser to apply certain security measures. They’re invisible to the user, but protect against attacks like clickjacking, MIME sniffing or insecure redirects.

In this article you’ll see the most important ones and how to configure them.

Most important security headers

1. Strict-Transport-Security (HSTS)

Forces the browser to always use HTTPS. Prevents HTTP downgrade attacks.

Strict-Transport-Security: max-age=31536000; includeSubDomains

2. X-Frame-Options

Prevents your website from being embedded in another website’s iframe. Prevents clickjacking.

X-Frame-Options: SAMEORIGIN

3. X-Content-Type-Options

Prevents the browser from guessing a file’s type (MIME sniffing).

X-Content-Type-Options: nosniff

4. Content-Security-Policy (CSP)

Defines what resources (scripts, styles, images) your website can load. It’s the most powerful but also the most complex.

Content-Security-Policy: default-src 'self'

5. Referrer-Policy

Controls what referrer information is sent when navigating.

Referrer-Policy: strict-origin-when-cross-origin

6. Permissions-Policy

Controls what browser APIs your website can use (camera, microphone, geolocation).

Permissions-Policy: geolocation=(), microphone=()

How to configure them on Apache (cPanel)

Edit the .htaccess file:

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

At miHosting, if your plan uses LiteSpeed, headers are configured the same as on Apache through .htaccess.

How to configure them on Nginx

In the nginx.conf file or in the server block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

On WordPress

In addition to .htaccess, you can use plugins:

• HTTP Headers: allows configuring all headers from the panel.
• Really Simple SSL: adds HSTS automatically when forcing HTTPS.

How to check if your website has them

1. Go to securityheaders.com.
2. Type your URL.
3. It shows you a score from A+ to F and what headers are missing.

A score of A or A+ is the goal. If you have F or C, you’re missing headers.

Useful tips

• Start with the basics. HSTS, X-Frame-Options and X-Content-Type-Options are easy and very effective.
• CSP is powerful but delicate. A misconfigured CSP can break your website. Test it in Report-Only mode before enabling.
• Back up .htaccess before editing. An error can break the entire website.
• Check after configuring. Use securityheaders.com to verify.
• Combine with HTTPS. HSTS only works if you already have SSL active.

Frequently asked questions

Do headers affect SEO?

Not directly, but they improve security and trust, which is positive.

Can they break my website?

Most don’t. But a misconfigured CSP can block legitimate scripts. Test before enabling.

Does my hosting configure them by default?

Some yes (like HSTS if you force HTTPS). Others you must configure. At miHosting, we help you if needed.

Are they mandatory?

Not by law, but they’re recommended by Google and by web security standards.

Security headers: invisible but effective protection

HTTP security headers are an invisible protection layer for your visitors but very effective against attacks. Configuring them is free and takes a few minutes.

If you need help configuring security headers on your miHosting hosting, open a ticket from your client panel.