The HTTP security headers every launch should validate
A practical header guide that reads like a launch checklist and keeps the remediation advice short enough to act on.
Header primer
CSP is the highest leverage header on the list
A good Content-Security-Policy reduces the blast radius of XSS and makes the browser a better gatekeeper. Start with a narrow policy and expand only where needed.
Quick fix
default-src 'self' and test in report-only mode before you enforce it.Clickjacking
Frame protection should be obvious and boring
If the site should never be embedded, say so directly. If you need to allow specific embeds, do it intentionally with a policy instead of leaving it open by accident.
- Use X-Frame-Options or an equivalent frame-ancestors rule.
- Prefer the policy that matches the actual embed requirement.
- Keep the remediation one line and easy to verify.
Transport
HSTS is a trust lock once HTTPS is stable
Only enable it after HTTPS is fully correct. The point is to force browsers back onto secure transport, not to paper over a broken certificate setup.
Quick fix
Strict-Transport-Security: max-age=31536000; includeSubDomains after you confirm the redirect path is clean.Browser hygiene
Nosniff is a cheap win
The nosniff header stops browsers from guessing content types. It is low risk, easy to explain, and should ship early in any baseline hardening pass.
- Add X-Content-Type-Options: nosniff.
- Treat it as a baseline control, not an advanced one.
- Use it to remove accidental browser behavior, not to compensate for weak uploads.
Launch order
The minimum viable header set should be sequenced
Some headers are safer to ship before others. Make the order part of the advice so the user does not have to guess what to do first.
Nosniff
Ship immediately. It is the easiest safe header to add.
Framing controls
Close clickjacking paths as soon as possible.
HSTS
Enable after HTTPS is correct across the public surface.
CSP report-only
Measure before you enforce.
Next action
Run the scanner against your own site
The article lands hardest when it turns into a fix list. Scan, close the gaps, and recheck.
Continue reading
More field notes
Launch Ops
The Small Business Trust Checklist: 10 Things Customers Check Before Buying
Before a customer buys from you, they run a mental checklist. Most of it happens in under 30 seconds. Here are the 10 signals that decide whether they stay — and how to verify each one.
Open articleSecurity
Why Your 'Secure' Badge Might Be Lying to Your Customers
Security seals can help, but a badge image is not proof by itself. Here is what common trust signals actually verify, what they leave out, and what real domain-bound proof looks like.
Open articleSecurity
I Got Duped by a Fake Supplier. Here's the 5-Minute Check I Do Now.
A real story about getting burned by a convincing supplier clone — and the exact five-minute verification checklist I built afterward so it never happens again.
Open article