Which security headers should my website send?

Five headers, one transport check, and a letter grade with fixed bands — 90 is an A, below 60 an F.

Five response headers cover the ground most small-business sites need, and they are exactly the five our scan reads from your homepage response: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy. Each is one line of server configuration; none requires changing your site's content.

The five, and what each protects

• Strict-Transport-Security — tells browsers to refuse plain HTTP for your domain, so a downgraded connection is not an option.
• Content-Security-Policy — constrains what the page is allowed to load and execute, which is the practical defence against injected scripts.
• X-Content-Type-Options — tells browsers not to guess at content types, closing a class of smuggling tricks.
• X-Frame-Options — controls whether your page can be framed by someone else's site; a Content-Security-Policy that covers framing counts instead.
• Referrer-Policy — decides how much of your URLs leaks to the sites you link to.

How the score and grade work

The scan reads the five headers plus the transport itself and rolls them into a 0-100 security score with a letter grade at fixed bands: 90 and above is an A, 80 a B, 70 a C, 60 a D, and anything below that an F. The bands don't move, so the grade means the same thing on every site and every re-scan — improving it is a matter of adding headers, not of grading on a curve.

What this check deliberately is not

Reading response headers is not a penetration test. The scan does not probe ports, test firewalls or attack anything — it reads what your server volunteers on a single fetch. It also does not claim to read your SSL certificate's expiry date, because the platform it runs on cannot inspect the peer certificate; a check that cannot run reports nothing rather than a guess. What it measures, it measures the same way every time.

Straight answers

Which header should I add first?

Strict-Transport-Security, assuming your site already serves HTTPS — it is one line, breaks nothing on a correctly configured site, and closes the plain-HTTP downgrade path. Content-Security-Policy is the most protective and the most work; add it deliberately.

Will these headers change how my site looks or works?

Four of the five, no — they constrain attackers, not your own pages. Content-Security-Policy is the exception: it blocks anything you didn't allow, including your own third-party widgets, so test it before enforcing it.

What grade do most small-business sites get?

The scan grades on fixed bands rather than a curve, and most sites we scan send few or none of the five headers — the grade exists to make that visible. Your own site's answer takes about a minute on the free scan.

Is a good header grade the same as being secure?

No — it means your server sends the protections browsers can enforce. It says nothing about your application's own code, your passwords, or your hosting. It is one measured layer, reported honestly as that.

Related

• Which website security checks the scan actually runs
• What are SPF, DKIM and DMARC?
• How is a website health score calculated?
• Antileak website and network security: how it works