Domain security
Which HTTP security headers should every website send?
Every website should send Strict-Transport-Security, a Content-Security-Policy, X-Content-Type-Options: nosniff, a frame-ancestors rule to stop clickjacking, a Referrer-Policy and a Permissions-Policy. Start Content-Security-Policy in report-only mode, because a strict policy can break scripts you rely on.
The checklist
| Header | Example value | What it does |
|---|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains | Forces HTTPS |
| Content-Security-Policy | default-src 'self'; frame-ancestors 'none' | Limits where scripts, styles and frames may load from |
| X-Content-Type-Options | nosniff | Stops browsers guessing file types |
| Referrer-Policy | strict-origin-when-cross-origin | Limits what URL data is sent to other sites |
| Permissions-Policy | camera=(), microphone=(), geolocation=() | Turns off browser features you do not use |
Content-Security-Policy, carefully
CSP is the most powerful and the easiest to get wrong. Begin with Content-Security-Policy-Report-Only so the browser reports problems without blocking anything, fix what the reports show, then enforce.
Clickjacking
Use the CSP frame-ancestors directive to control who may embed your pages. The older X-Frame-Options header still works as a fallback.
Skip the obsolete ones
X-XSS-Protection is deprecated in modern browsers and can introduce problems. A good CSP replaces it.
How to add them
Set them at your host or CDN: in vercel.json headers, an nginx add_header, or your framework’s middleware. Then check the live response with curl -I https://www.example.com.
How SageRank helps
The free report does not test domain security. SageRank’s Sentinel and Ultimate plans run ten levels of domain security checks through ShieldAI. See ShieldAI.