Security Headers

Security headers are HTTP response headers that your Web server sends along to a visitor's browser. They contain instructions on how the browser should interact with your website content to prevent attacks such as cross-site scripting(XSS), clickjacking and man-in-the-middle attacks. In practice, they work as a set of security rules that you activate at the server level, without having to modify your Web site code. For SMBs with an ecommerce store, customer portal or WordPress site, security headers are one of the most effective and approachable ways to increase security.

How security headers work at the technical level

Every time a browser requests a page from your website, your web server sends back an HTTP response. That response consists of the visible content (HTML, CSS, images) plus a series of headers with metadata. Security headers are specific instructions within that metadata. For example, a header like Content-Security-Policy tells the browser which scripts, images and style sheets it may or may not load. X-Frame-Options blocks your site from loading into an iframe on another Web site, preventing clickjacking. Strict-Transport-Security enforces HTTPS even if a user accidentally follows an HTTP link. These headers are interpreted by modern browsers and thus work without visitors noticing.

Why security headers came into being and why they are crucial now

Security headers were developed from the early 2000s in response to large-scale attacks in which malicious actors took advantage of the way browsers handled external content. Cross-site scripting, where attackers inject scripts into your site, was one of the most common vulnerabilities. Browsers initially executed any code they encountered without looking critically at the source. With the introduction of headers such as Content-Security-Policy and X-XSS-Protection, Web site owners gained the ability to limit that default behavior for the first time. According to the W3C Content Security Policy Level 3 specification, these headers are now part of the Web standard. In practice, websites without security headers are more vulnerable to data theft, phishing and reputation damage.

What security headers bring to SMEs

For a Dutch ecommerce store or service provider with a customer portal, security headers directly reduce the risk of data breaches and attacks. An ecommerce store that processes personal data and payment information must comply with the GDPR’s security requirements. Security headers are one of the technical measures you can demonstrate during an audit. In addition, search engines like Google rank sites with a strong security configuration higher because they are safer for users. In a well-configured managed WordPress hosting environment, security headers are set by default at the server level, so as a business owner, you don’t have to work with .htaccess files yourself. The result is a site that’s better protected against attacks, without sacrificing speed or user-friendliness.

Security headers are not just for large platforms or banks. An SME ecommerce store with 500 products or a B2B service provider with a customer portal also benefit directly from this technology. Below you can read where to deploy security headers in practice and which headers are most relevant for Dutch companies.

Protection against cross-site scripting in ecommerce stores and forms

Cross-site scripting (XSS) is an attack in which a hacker injects malicious scripts into your Web site, such as through a non-well-protected contact form or product review field. Those scripts can steal login credentials or redirect visitors to phishing pages. The Content-Security-Policy (CSP) header prevents this by telling the browser which scripts it can execute. For example, you can set that only scripts from your own domain and from Google Analytics are allowed to run. For an ecommerce store running on WooCommerce or Shopify, this means that your forms and checkout flows are better protected. In practice, we find in ecommerce store development projects that a strict CSP sometimes conflicts with external plugins or tracking scripts. Therefore, set your CSP in report-only mode during the testing phase, so you can see which scripts are blocked without breaking your site.

Preventing clickjacking at customer portals and login pages

Clickjacking is an attack technique where a hacker loads your login page into an invisible iframe on another site. Visitors think they are logging into your site, but in reality click on buttons placed by the attacker. The X-Frame-Options header prevents this by prohibiting browsers from loading your pages in an iframe. For an SMB with a customer portal, online billing environment or B2B platform, this is essential. You set X-Frame-Options to DENY (no iframes at all) or SAMEORIGIN (only iframes from your own domain). An alternative is the frame-ancestors-directive within Content-Security-Policy, which offers more flexibility. In a well-secured Web development environment, these headers are included by default, so your login pages cannot be abused.

Enforcing HTTPS connections with Strict Transport Security

Strict-Transport-Security (HSTS) is a header that forces browsers to communicate with your site only via HTTPS, even if a user accidentally follows an HTTP link. This prevents man-in-the-middle attacks in which an attacker places himself between the user and your server to intercept data. For an ecommerce store or service provider that processes personal data, HSTS is a hard requirement from the Personal Data Authority. You set HSTS with a max-age value (for example, one year) and optionally the includeSubDomains-directive if you also want to protect subdomains. Note that HSTS is irreversible for the duration of the max-age period. If you disable HTTPS later, visitors will no longer be able to reach your site. Therefore, test with a short max-age value first before permanently activating the header.

When security headers are the right choice and when they are not

Security headers almost always make sense, but configuration varies by situation. For a static website without forms or login functionality, basic headers such as X-Content-Type-Options and Referrer-Policy suffice. For an ecommerce store or customer portal, you need a strict Content-Security-Policy and HSTS. Security headers are no substitute for other security measures such as regular updates, strong passwords and two-factor authentication. They work best as part of a broader security strategy. If your site depends on many external scripts (ad networks, chatbots, A/B testing tools), too strict CSP can cause functionality to fail. In that case, set CSP gradually and monitor console errors in your browser to see which resources are being blocked.