Which security headers should every site have?

At minimum: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Add Content-Security-Policy for XSS protection and Permissions-Policy for feature control.

Is it safe to add all security headers at once?

X-Content-Type-Options, Referrer-Policy, and Permissions-Policy are safe to add immediately. HSTS requires HTTPS to be fully working. CSP requires testing — use report-only mode first.

What is Permissions-Policy?

Controls which browser features (camera, microphone, geolocation) your page and embedded iframes can access. Setting them all to () disables them entirely.

Generator

Security Headers Generator

Configure your security headers and get copy-paste config for your stack. Safe defaults are pre-selected — adjust for your specific setup.

Scan your live site → HeadersFixer