What is a security header?

A security header is an instruction your web server sends to every visitor’s browser alongside each page, telling the browser to enforce a protection it would otherwise skip. The common ones:

• Strict-Transport-Security - refuse unencrypted connections.
• Content-Security-Policy - only run scripts from approved sources.
• X-Frame-Options - don’t let other sites embed this page.
• Referrer-Policy - don’t leak where the visitor goes next.

Headers are invisible to visitors and absent by default: a site without them looks identical to one with them, right up until something exploits the gap. Four in five Australian small business websites have no Content-Security-Policy header^*. Adding headers is configuration, not development - a short block in the server or hosting control panel, checkable in 30 seconds with a free header scanner. Security headers are the cheapest hardening a website can get: one paste, permanent effect.