← Blog  ·  October 2026

HTTP Security Headers: What They Are and How to Monitor Them (2026)

A practical guide to the 6 most important security headers — what each one does, how to add it to nginx/Apache/your app, and why monitoring header changes catches regressions before your security scanner does.

HTTP security headers are response headers your web server sends to browsers. They tell the browser how to behave with your content — whether to allow it in an iframe, how to handle mixed content, which origins can load resources, and more. Getting them right is a one-time effort. The problem is keeping them right.

A deployment can silently remove a header. A CDN configuration change can override your headers. A new nginx config can reset everything to defaults. Without monitoring, you find out weeks later — usually from a security scanner or a bug bounty report.

The 6 headers that matter most

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'

X-Frame-Options: SAMEORIGIN

X-Content-Type-Options: nosniff

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy: camera=(), microphone=(), geolocation=()

How to add them: nginx, Apache, and app-level

nginx

server {
    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    # CSP — customize for your app
    add_header Content-Security-Policy "default-src 'self'" always;
}

Apache

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

Express / Node.js (via Helmet)

import helmet from 'helmet';

app.use(helmet());
// Helmet sets sensible defaults for all major security headers
// Customize specific headers:
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", "https://cdn.example.com"],
  }
}));

Vercel (vercel.json)

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "X-Frame-Options", "value": "SAMEORIGIN" },
        { "key": "X-Content-Type-Options", "value": "nosniff" },
        { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" },
        { "key": "Strict-Transport-Security", "value": "max-age=63072000; includeSubDomains" }
      ]
    }
  ]
}

Quick reference: header grades

Why monitoring header changes matters

Headers are easy to set and just as easy to accidentally remove. Common regression scenarios:

• nginx config reload — a new config template from a framework or ops team that doesn't include your security headers
• CDN reconfiguration — CDN-level headers override origin headers; a CDN config change can silently remove HSTS
• Framework upgrade — a new version of your web framework changes default response headers
• Docker image update — base image update changes nginx defaults
• Migration to new infrastructure — the security headers were on the old server but not configured on the new one

External header monitoring catches regressions within minutes. The alert goes to email or Slack; the engineer fixes the config and redeploys; the headers are back before users are exposed for any meaningful period.

← All articles  ·  HeaderGuard  ·  Free security headers checker