{"id":18932,"date":"2026-10-21T20:17:45","date_gmt":"2026-10-21T17:17:45","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/security-headers\/"},"modified":"2026-10-21T20:17:53","modified_gmt":"2026-10-21T17:17:53","password":"","slug":"security-headers","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/security-headers\/","title":{"rendered":"Security Headers: What They Are and How to Add Them to Your Website"},"content":{"rendered":"
\n
In short<\/b>Security headers are lines the server sends with every page, asking the browser to behave more safely: always open your site over https, never show your site inside other sites, never guess file types, and only load scripts from approved sources. You add them with a few lines in .htaccess and test them with a free tool.<\/div>\n
\"Security<\/figure>\n

The most important security headers<\/h2>\n
\n\n\n\n\n\n\n\n\n\n\n
Header<\/th>\nWhat it does<\/th>\nSuggested value<\/th>\n<\/tr>\n<\/thead>\n
Strict-Transport-Security (HSTS)<\/td>\nForces the browser to always open your site over https.<\/td>\nmax-age=31536000<\/code><\/td>\n<\/tr>\n
X-Content-Type-Options<\/td>\nStops the browser guessing file types and running an uploaded file as a script.<\/td>\nnosniff<\/code><\/td>\n<\/tr>\n
X-Frame-Options<\/td>\nStops your pages being shown in a frame on another site to trick visitors into clicking.<\/td>\nSAMEORIGIN<\/code><\/td>\n<\/tr>\n
Referrer-Policy<\/td>\nControls what part of your page URL is sent when visitors go to another site.<\/td>\nstrict-origin-when-cross-origin<\/code><\/td>\n<\/tr>\n
Permissions-Policy<\/td>\nTurns off browser features you do not need, such as camera and location.<\/td>\ncamera=(), microphone=(), geolocation=()<\/code><\/td>\n<\/tr>\n
Content-Security-Policy (CSP)<\/td>\nLists the sources allowed for scripts and images, making XSS<\/a> harder.<\/td>\nNeeds tuning for each site<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

How to add them<\/h2>\n
    \n
  1. Back up your .htaccess file:<\/b> From the cPanel File Manager in your site folder, so you can restore it if something breaks.<\/li>\n
  2. Make sure your whole site works on https:<\/b> Before adding HSTS, because browsers will refuse the unencrypted version for a long time. Read how to enable HTTPS on your website<\/a>.<\/li>\n
  3. Add the lines at the top of the file:<\/b> Copy the lines below and save.<\/li>\n
  4. Open your site and test key pages:<\/b> Home page, dashboard, contact form and checkout.<\/li>\n
  5. Test the result:<\/b> A free tool such as securityheaders.com<\/code> shows which headers are present and missing.<\/li>\n<\/ol>\n
    <IfModule mod_headers.c>\n  Header always set Strict-Transport-Security "max-age=31536000"\n  Header always set X-Content-Type-Options "nosniff"\n  Header always set X-Frame-Options "SAMEORIGIN"\n  Header always set Referrer-Policy "strict-origin-when-cross-origin"\n  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"\n<\/IfModule><\/pre>\n
    Be careful with CSP:<\/b> a strict CSP can block analytics, payment and chat scripts. Start in report-only mode with Content-Security-Policy-Report-Only<\/code>, and enforce it once you are sure.<\/div>\n
    If your site uses Cloudflare:<\/b> you can enable HSTS in the Cloudflare SSL\/TLS settings instead of the file. Do not set it in both places with different values.<\/div>\n
    \n
    How Hyyat Host protects your site<\/h2>\n