DDoS, WAFs, Bots, and Edge Protection
Continue through the next layer of the domain-to-browser path.
Read the guide →Plain-English security
What are security headers, and why does every scanner flag them?
Security headers are short instructions your website sends to every visitor's browser telling it what to refuse — refuse to display your site inside someone else's page, refuse to run scripts from unknown sources, refuse to ever connect insecurely. They cost nothing, change nothing visible, and close off a whole family of attacks aimed at your visitors through your site.
What they prevent, concretely
- Clickjacking. An attacker embeds your site invisibly inside their own page, so a visitor who thinks they're clicking something harmless is really clicking a button on yours. One header makes browsers refuse to render your site framed.
- Script injection. If a weakness ever lets an attacker slip a script into one of your pages, a Content-Security-Policy is the difference between “the browser refuses to run it” and “every visitor's browser runs it.” It's the seatbelt for a crash you hope never happens.
- Content-type tricks and leaky referrers. Two more one-line headers stop browsers from second-guessing file types and stop your site from leaking visitors' browsing details to other sites.
Why almost nobody sets them
They're invisible. A site with zero security headers looks identical to one with a perfect set — same design, same speed, same padlock. Nothing breaks and no customer complains, so they never get set. They become visible in exactly two moments: when a scanner grades the site, and when the attack they would have stopped succeeds.
They're also genuinely fiddly. A Content-Security-Policy that's too strict breaks your own fonts, analytics, or embedded maps — which is why half-finished policies get commented out and forgotten. The safe path is running the policy in report-only mode first, then enforcing once it's proven clean.
For what it's worth, wolfwarden.com holds an A on the independent scanner securityheaders.com — check it yourself — and that's the same configuration work applied to every site we host.
Check your own site in 30 seconds
The free WolfWarden scan reads this — plus seven other fundamentals — from public information and grades it in plain English. Nothing to install. Ordinary results may be cached briefly to prevent abuse; no lasting report is created unless you choose to share one.
Run the free scanCommon questions
Will adding security headers break my website?
Most are safe to add immediately. Content-Security-Policy is the exception — done carelessly it can block your own fonts or analytics, which is why the right path is report-only mode first, then enforcement.
Do security headers slow the site down?
No. They're a few hundred bytes of text on each response — no measurable performance cost.
My site has never been hacked. Do these actually matter?
Headers are seatbelts: their value shows up in the incident that doesn't become a disaster. They cost nothing to wear, and their absence is one of the first things automated attackers check for.
If you'd rather not manage this
The relevant service page explains what WolfWarden can handle, what the public scan cannot see, and where a managed plan or focused project fits.