Which security headers should your site send?
A small set of instructions your site sends with every page, telling the browser to enforce rules that make common attacks much harder. They cost nothing to serve and their absence is one of the first things a technical evaluator notices.
What it actually is
Alongside the page itself, a site sends a handful of instructions the visitor never sees. The useful ones do things like insisting the connection stays encrypted, refusing to let your pages be framed inside someone else's site, stopping the browser from second-guessing what a file is, and limiting what information leaks to the sites your visitors move on to.
Why it matters
Two reasons, and the second surprises people. The first is the obvious one: these headers close off well-understood attack routes, including the kind used to trick your logged-in users into acting against themselves. The second is commercial — security headers are trivially inspectable from outside, so anyone assessing you can check them in seconds. Buyers, partners and security questionnaires all do exactly that.
What good looks like
A site that sends the core protective instructions on every response rather than on the homepage alone: enforced encryption, framing restricted, content types taken at face value, and a sensible limit on what gets passed to other sites. What matters is coverage and consistency — the whole site, not the one page somebody remembered.
Being honest about it
These headers protect the person browsing your site, and they do not move your score: a crawler or an AI fetcher receives the same page with or without them. These are hygiene rather than a growth lever. They will not win you a ranking or an AI citation, and no visitor will ever thank you. We include them because they are cheap, they are checked by people who matter, and their absence usually indicates nobody has looked at the infrastructure in a while — which tends to be true of more than just the headers.
Where most sites go wrong
The most common pattern is partial coverage: protections present on the main site but missing on a subdomain, a landing-page tool, or whatever is serving the blog. Attackers and assessors both look at the whole estate, not the part you maintain most carefully. The other frequent problem is a policy so permissive it satisfies a checklist while permitting everything it was meant to restrict.
On the web
State of the Web · November 2026In November 2026, 8% of the sites we could read passed the “Core security headers are set” check.
Next.js sites pass it most often, at 41%. Webflow sites pass it least often, at 2%.
On the sites scanned in both October 2026 and November 2026, it stayed at 24%.
The month-by-month line counts the sites scanned in each calendar month, so it can differ from the figure above, which uses each site’s latest scan from the last three months.
Goes with
-
Sites that pass this are 9 times as likely to pass the “security.txt is published” check too. 25% of the sites that pass the first check pass this one, against 3% of the sites that do not.
-
Sites that pass this are 4 times as likely to pass the “Clean content for agents (Markdown)” check too. 14% of the sites that pass the first check pass this one, against 3% of the sites that do not.
-
Sites that pass this are 3.5 times as likely to pass the “Content usage preferences declared” check too. 11% of the sites that pass the first check pass this one, against 3% of the sites that do not.
Not enough history yet.
Based on the sites Bot Appétit has scanned. Most of these sites come from lists we scan for research. Not a random sample of the web.
Not sure where yours stands?
A free scan checks this and everything else in about 20 seconds — no signup. Or if it's already flagged and you'd rather it were simply handled, we do that too.
Flagged for this one? We handle it. No pitch, just a plain-English chat.
Book a call