---
title: "Security Headers: What They Are and How to Add Them to Your Website"
description: "**In short**Security headers are lines the server sends with every page, asking the browser to behave more safely: always open your site over https, never show your site inside other sites, never guess file types, and only load scripts from…"
url: "https://www.hyyat.com/en/knowledgebase/security-headers/"
updated: "2026-10-21"
category: Website Security
---

# Security Headers: What They Are and How to Add Them to Your Website

**In short**Security headers are lines the server sends with every page, asking the browser to behave more safely: always open your site over https, never show your site inside other sites, never guess file types, and only load scripts from approved sources. You add them with a few lines in .htaccess and test them with a free tool.

![Security headers: a browser window with a list of security settings and a large shield](https://www.hyyat.com/wp-content/uploads/2026/10/hkb-security-headers.webp)

## The most important security headers

| Header | What it does | Suggested value |
| --- | --- | --- |
| Strict-Transport-Security (HSTS) | Forces the browser to always open your site over https. | `max-age=31536000` |
| X-Content-Type-Options | Stops the browser guessing file types and running an uploaded file as a script. | `nosniff` |
| X-Frame-Options | Stops your pages being shown in a frame on another site to trick visitors into clicking. | `SAMEORIGIN` |
| Referrer-Policy | Controls what part of your page URL is sent when visitors go to another site. | `strict-origin-when-cross-origin` |
| Permissions-Policy | Turns off browser features you do not need, such as camera and location. | `camera=(), microphone=(), geolocation=()` |
| Content-Security-Policy (CSP) | Lists the sources allowed for scripts and images, making [XSS](https://www.hyyat.com/en/knowledgebase/xss-cross-site-scripting/) harder. | Needs tuning for each site |

## How to add them

1. **Back up your .htaccess file:** From the cPanel File Manager in your site folder, so you can restore it if something breaks.
2. **Make sure your whole site works on https:** Before adding HSTS, because browsers will refuse the unencrypted version for a long time. Read [how to enable HTTPS on your website](https://www.hyyat.com/en/knowledgebase/enable-https-on-your-website/).
3. **Add the lines at the top of the file:** Copy the lines below and save.
4. **Open your site and test key pages:** Home page, dashboard, contact form and checkout.
5. **Test the result:** A free tool such as `securityheaders.com` shows which headers are present and missing.

```
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>
```

 **Be careful with CSP:** a strict CSP can block analytics, payment and chat scripts. Start in report-only mode with `Content-Security-Policy-Report-Only`, and enforce it once you are sure. **If your site uses Cloudflare:** you can enable HSTS in the Cloudflare SSL/TLS settings instead of the file. Do not set it in both places with different values.

## How Hyyat Host protects your site

- Our **LiteSpeed** and Apache servers read Header directives in .htaccess directly.
- A **free SSL certificate** is issued automatically on most plans, and it is required before HSTS.
- **ModSecurity** and **Imunify360** rules complement security headers by blocking attacks at the server level.

## Frequently asked questions

   Do security headers improve my Google ranking?

They are not a direct ranking factor, but they protect your visitors and reduce the chance of a hack that would hurt your visibility.

   Is HSTS risky for my site?

Only if you add it before your whole site works on https. After that it is one of the most important headers.

   Is there a WordPress plugin for security headers?

Yes, some security plugins add them. But adding them in .htaccess is lighter and also covers static files.

   **Related guides**

- [What Is an XSS Attack? Cross-Site Scripting Explained and How to Prevent It](https://www.hyyat.com/en/knowledgebase/xss-cross-site-scripting/)
- [How to Protect wp-config.php in WordPress: 7 Steps to Secure Your Most Important File](https://www.hyyat.com/en/knowledgebase/protect-wp-config/)
- [What Is an SSL Certificate and How Does It Work?](https://www.hyyat.com/en/knowledgebase/what-is-an-ssl-certificate/)
- [How to Protect Your Website from Hacking: 10 Practical Steps](https://www.hyyat.com/en/knowledgebase/protect-website-from-hacking/)

[All website security guides →](https://www.hyyat.com/en/kb/website-protection/)

  **Need this service from Hyyat Host?**Our team handles it for you, with support replying to tickets within 24 hours at most.[Web Hosting](https://www.hyyat.com/en/hosting/)[Saudi Hosting](https://www.hyyat.com/en/saudi-hosting/)