Guides · ← All guides
Security Headers Missing? What Each Header Stops
Last updated: October 31, 2026 · Reviewed October 2026 · 7 min read
Security headers are the best deal in web security: protections the browser vendors already built, shipped to every visitor, switched on by a single line in your server's response. They are also the finding owners dismiss fastest — "it's just a header" — right up until the class of attack that header exists to stop shows up in an incident report. Here is the exact set BreachHunter's web audit checks, what each one stops, and the fix, taken from the scan's own check definitions.
What does each header stop?
| Header | Attack it stops | If missing | The fix (one line) |
|---|---|---|---|
| Content-Security-Policy | Cross-site scripting and data injection — the browser refuses scripts and resources from sources you never approved | MEDIUM | Send a CSP that whitelists the script, style and image sources your site actually uses |
| Strict-Transport-Security (HSTS) | Protocol downgrade / SSL-stripping — an attacker forcing visitors onto plain HTTP | MEDIUM | Strict-Transport-Security: max-age=31536000; includeSubDomains on every HTTPS response |
| X-Frame-Options | Clickjacking — your site embedded invisibly inside an attacker's page | MEDIUM | X-Frame-Options: DENY (or frame-ancestors in your CSP) |
| X-Content-Type-Options | MIME-sniffing — browsers guessing a file's type and executing an upload as a script | MEDIUM | X-Content-Type-Options: nosniff on every response |
| Referrer-Policy | URL leakage — full page addresses, tokens included, sent to third-party sites in the Referer header | LOW | Referrer-Policy: strict-origin-when-cross-origin (or stricter) |
| Permissions-Policy | Device access by any script on the page — camera, microphone, geolocation requested without your intent | LOW | Send a Permissions-Policy disabling the features you do not use, e.g. camera=(), microphone=() |
Source: SECURITY_HEADERS table, BreachHunter engine (app/pentest.py) — severity, explanation and fix text as the scanner reports them, read October 31, 2026.
Why is Content-Security-Policy the hard one?
Five of the six headers describe a single behavior and can be added in minutes. CSP describes your whole site: every origin your pages legitimately load scripts, styles, fonts and images from. Guess wrong and your own checkout breaks. That is why the standard rollout is report-only first — send Content-Security-Policy-Report-Only with your draft policy, collect a few days of violation reports, fix the allow-list, then enforce. It is also why CSP is worth the effort: when an attacker does find an injection point on your site, a strict policy is often the difference between a defaced comment and stolen sessions.
Why does HSTS come before the others on a login site?
Because of the first visit problem. A visitor who types your domain without HTTPS can be intercepted before the redirect — the classic SSL-strip. HSTS tells every returning browser "never speak to this site over HTTP again", and with includeSubDomains and preload it can cover the first visit too. If your site has a login, a checkout, or an admin panel, this is the header whose absence has the most direct line to credential theft. BreachHunter's TLS module reports it alongside your certificate — see how the TLS phase of an assessment works.
How do you check your own headers right now?
curl -I https://your-site.com
Read the response block: each of the six headers should appear by name. Or skip the squinting — the free BreachHunter scan checks all six, plus the HttpOnly, Secure and SameSite flags on your cookies, and returns each missing header with its fix written out. Where does this sit among everything else a scan finds? Headers are this-week work, not same-day emergencies — our triage guide explains the ordering: which findings to fix first.
Check your headers with the free scan →
Frequently asked questions
Are missing security headers dangerous on their own?
A missing header is not a breach — it is a declined protection. Each header switches on a browser-enforced defense against a whole class of attack. Sites are rarely compromised because a header was missing; they are compromised faster and worse when one was. That is why BreachHunter rates most missing headers MEDIUM: cheap to fix, real protection gained.
Which security header matters most?
Start with Strict-Transport-Security if you serve any login or payment page — it prevents protocol downgrade attacks. Then Content-Security-Policy, the strongest of the six against cross-site scripting, though it needs care: a too-strict CSP can break your own scripts, so roll it out in report-only mode first.
How do I check my site's security headers?
Run curl -I https://your-site.com and read the response headers, or run the free BreachHunter scan — its web audit checks all six headers plus your cookie flags and reports each missing one with its fix.
Will adding these headers break my site?
Five of the six are safe to add as-is for most sites. The exception is Content-Security-Policy: deploy it first as Content-Security-Policy-Report-Only, watch what it would have blocked, adjust the allow-list, then enforce.