Your website looks great. It loads fast. SSL certificate is in place. You think you're secure.
Then you run a scan on securityheaders.com and see a big red F.
What does this mean? Is your site actually vulnerable? And why did nobody tell you about this?
What Are Security Headers?
Security headers are HTTP response headers that tell browsers how to behave when handling your site's content. They're invisible to users but critical for security.
Think of them as instructions your server gives to visitors' browsers: "Don't let other sites embed me." "Only load scripts from trusted sources." "Always use HTTPS."
Without these headers, browsers use default behaviors—and those defaults often favor compatibility over security.
What Does an F Grade Mean?
An F grade on securityheaders.com means your server is sending none of the recommended security headers. Your site is relying entirely on browser defaults, leaving visitors exposed to several attack vectors.
Here's what's typically missing and what each protects against:
Strict-Transport-Security
Forces HTTPS connections. Without it, attackers can perform man-in-the-middle attacks and SSL stripping.
Content-Security-Policy
Controls which resources can load on your page. Without it, your site is vulnerable to cross-site scripting (XSS) and data injection attacks.
X-Frame-Options
Prevents your site from being embedded in frames. Without it, attackers can perform clickjacking—tricking users into clicking hidden buttons on your site.
X-Content-Type-Options
Prevents browsers from "sniffing" file types. Without it, attackers can disguise malicious scripts as innocent files.
Referrer-Policy
Controls what information is sent when users navigate away. Without it, sensitive data in URLs can leak to third parties.
Permissions-Policy
Restricts access to browser features like camera and microphone. Without it, malicious scripts could potentially access these features.
Real-World Attack Scenarios
The Coffee Shop Attack
An attacker on public WiFi intercepts the initial HTTP request before it redirects to HTTPS. They strip the SSL and the user continues on an insecure connection without knowing. All data—passwords, forms, sessions—transmitted in plain text.
The Invisible Click
An attacker creates a page with your site loaded in an invisible iframe. They overlay fake buttons. When users think they're clicking something innocent, they're actually clicking buttons on your site—transferring money, changing settings, granting permissions.
The Injected Script
An attacker finds a way to inject a script tag into your page through a comment field, URL parameter, or compromised third-party resource. Without protection, the browser happily executes it—stealing cookies, capturing keystrokes, redirecting users to phishing sites.
The Disguised File
An attacker uploads a file that looks like an image but contains JavaScript. Without proper headers, some browsers might execute it as code instead of displaying it as an image.
Why Don't Most Websites Have These?
- Not enabled by default - Web servers ship without security headers configured
- Invisible problem - Unlike broken layouts, missing headers don't show during development
- Not in tutorials - Most deployment guides skip security hardening
- Fear of breaking things - Some headers can break functionality if misconfigured
- Assumed someone else handles it - Developers focus on features, assume hosting handles security
The result: millions of websites running with an F grade, completely unaware.
What You Gain With Proper Headers
- Protection against clickjacking - No one can embed your site in malicious frames
- Reduced XSS risk - Even if attackers find injection points, CSP limits what they can do
- Enforced HTTPS - Browsers will refuse to connect over insecure HTTP
- MIME attack prevention - Files are handled as intended, not as attackers want
- Privacy protection - Control over what referrer information leaves your site
- Feature restrictions - Malicious scripts can't access camera, microphone, or location
- Professional security posture - Demonstrates due diligence to clients and partners
- Compliance support - Many frameworks (PCI-DSS, ISO 27001) expect these controls
The Bottom Line
That F grade isn't just a bad score—it's a list of attack vectors your site is vulnerable to. Every day without these headers, your visitors are exposed to:
- Session hijacking
- Credential theft
- Clickjacking fraud
- Malware injection
- Data exfiltration
The fix is straightforward for someone who knows what they're doing. The configuration takes minutes. The protection lasts forever.
Is your website protected? Check now at securityheaders.com
Want us to assess and fix your website's security headers? Get a free security scan.