Which security headers should your site send?
A small set of instructions your site sends with every page, telling the browser to enforce rules that make common attacks much harder. They cost nothing to serve and their absence is one of the first things a technical evaluator notices.
What it actually is
Alongside the page itself, a site sends a handful of instructions the visitor never sees. The useful ones do things like insisting the connection stays encrypted, refusing to let your pages be framed inside someone else's site, stopping the browser from second-guessing what a file is, and limiting what information leaks to the sites your visitors move on to.
Why it matters
Two reasons, and the second surprises people. The first is the obvious one: these headers close off well-understood attack routes, including the kind used to trick your logged-in users into acting against themselves. The second is commercial — security headers are trivially inspectable from outside, so anyone assessing you can check them in seconds. Buyers, partners and security questionnaires all do exactly that.
What good looks like
A site that sends the core protective instructions on every response rather than on the homepage alone: enforced encryption, framing restricted, content types taken at face value, and a sensible limit on what gets passed to other sites. What matters is coverage and consistency — the whole site, not the one page somebody remembered.
Being honest about it
These are hygiene rather than a growth lever. They will not win you a ranking or an AI citation, and no visitor will ever thank you. We include them because they are cheap, they are checked by people who matter, and their absence usually indicates nobody has looked at the infrastructure in a while — which tends to be true of more than just the headers.
Where most sites go wrong
The most common pattern is partial coverage: protections present on the main site but missing on a subdomain, a landing-page tool, or whatever is serving the blog. Attackers and assessors both look at the whole estate, not the part you maintain most carefully. The other frequent problem is a policy so permissive it satisfies a checklist while permitting everything it was meant to restrict.