When your browser requests a page, the server sends back the page content plus a set of hidden instructions called HTTP headers. Most headers are mundane (content type, cache rules), but a handful of them are purely defensive — they tell the browser "don't allow this," "never do that," or "only trust this source." Sites that skip these headers leave the browser to make its own risky default decisions, which attackers rely on.
None of these headers change how your site looks. They're invisible to visitors and cost nothing to add — which is exactly why missing headers are one of the most common, and most avoidable, security gaps PEKRYON finds.
| Header | What it stops |
|---|---|
| Content-Security-Policy (CSP) | Blocks malicious scripts from running if an attacker manages to inject code into your page (cross-site scripting). |
| Strict-Transport-Security (HSTS) | Forces browsers to only ever connect over HTTPS, even if someone types http:// or an old link points there. |
| X-Frame-Options | Stops your site being loaded inside an invisible iframe on someone else's page (clickjacking). |
| X-Content-Type-Options | Prevents the browser from "guessing" a file's type in a way that can be tricked into running disguised malicious files. |
| Referrer-Policy | Controls how much of your URL (including any sensitive query parameters) leaks to other sites when a visitor clicks a link away from your page. |
| Permissions-Policy | Restricts which browser features (camera, microphone, location) your page — and any embedded third-party scripts — are allowed to request. |
Each missing header maps to a real attack that has hit real companies: XSS attacks that steal login sessions, clickjacking that tricks users into approving actions they never intended, and MIME-sniffing exploits that disguise malware as an image. None of these require a sophisticated hacker — automated scanners crawl the web looking for sites without these headers specifically because they're such an easy, well-documented target.
Adding headers takes minutes, not days. If you're on WordPress, a plugin like HTTP Headers or a security plugin (Wordfence, Sucuri) can add most of these with a checkbox. If you manage your own server (Nginx, Apache, Cloudflare), your developer can add them directly in the server config using standard header-configuration syntax.
PEKRYON scans your website across 26 modules. We take the time needed for accurate results — no server access needed.
Scan My Website Free → Learn More