Security Guide · 2026

What Are Security Headers and Why They Matter

Q: What are HTTP security headers?

HTTP security headers are directives sent by a web server in the HTTP response that instruct the browser how to handle content security, cookie policies, framing restrictions, and other protective behaviors. They are invisible to end users but play a significant role in website security.

Q: Does a missing security header mean a site is a scam?

Not necessarily. Missing security headers mean the site is less secure, not necessarily fraudulent. However, when combined with other signals — a very new domain, no SPF or DMARC records, and suspicious pricing — their absence adds weight to a negative assessment.

Q: Which security header is most important?

For end-user safety, HSTS is arguably the most important because it forces encrypted HTTPS connections and prevents downgrade attacks. For content security, Content-Security-Policy (CSP) offers the broadest protection against script injection.

HTTP security headers instruct browsers how to handle selected security features. Their presence or absence does not establish whether a seller is trustworthy.

What Are HTTP Security Headers?

When your browser loads a website, the web server sends back not just the page content but also a set of HTTP response headers — metadata that tells the browser how to handle the connection and content. Security headers are a specific subset that instruct the browser to enforce protective behaviors: forcing encrypted connections, restricting which scripts can run, preventing iframe embedding, and more.

The 4 Key Security Headers

Strict-Transport-Security (HSTS)

High Importance

Tells browsers to always connect over HTTPS. Prevents attackers from downgrading your connection to unencrypted HTTP — a man-in-the-middle attack vector.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Content-Security-Policy (CSP)

High Importance

Defines which sources of scripts, styles, and images the browser is allowed to load. Prevents cross-site scripting (XSS) attacks — where malicious code tries to steal your session cookies or payment details.

X-Frame-Options

Medium Importance

Prevents the website from being embedded in an iframe on another domain — a technique used in clickjacking attacks.

X-Frame-Options: SAMEORIGIN

X-Content-Type-Options

Medium Importance

Prevents browsers from guessing content types, blocking techniques used to disguise malicious script files.

X-Content-Type-Options: nosniff

Security Headers as a Legitimacy Signal

Security headers help browsers apply selected protections, but their presence does not verify who operates a site or whether a seller will fulfil an order. Their absence alone does not show that a site is fraudulent.

Check any site: ScamPageFinder checks all four security headers automatically and includes them in the Technical Transparency Score.

Frequently Asked Questions

What are HTTP security headers?

HTTP security headers are directives sent by a web server that instruct the browser how to handle security behaviors — encrypted connections, script restrictions, framing prevention, and more.

Does a missing security header mean a site is a scam?

Not by itself. Missing headers mean the site is less secure, not necessarily fraudulent. Combined with a new domain, no SPF/DMARC, and suspicious pricing, their absence adds weight to a negative assessment.

Which security header is most important?

For end-user safety, HSTS is arguably the most critical because it forces HTTPS and prevents downgrade attacks. For content security, CSP provides the broadest protection against script injection.

Check any site's security headers free

ScamPageFinder checks HSTS, CSP, X-Frame-Options, and X-Content-Type-Options — plus domain age, WHOIS, SPF, and DMARC — in one instant report.

Analyze a Domain Free →