What security headers should my website have?

For a typical small business website, five security headers cover almost all the value, and four in five Australian small business sites are missing the most important one - 79% have no Content-Security-Policy^*:

• Strict-Transport-Security - forces every connection to use HTTPS and refuses the unencrypted version.
• Content-Security-Policy - controls which sources of scripts and content the browser will load, blocking injected code.
• X-Content-Type-Options: nosniff - stops the browser guessing a file’s type and running it as something it is not.
• X-Frame-Options - stops other sites embedding your pages to set up clickjacking.
• Referrer-Policy - limits how much of your address is leaked to the sites visitors click through to.

All five are configuration, not development - a short block in your server or hosting panel, verifiable in 30 seconds with a free header scanner. Add them once and they protect every page permanently.