Is Your Website Leaking Data Through the Referrer Header?

This week, TrustedWeb scanned 87 websites. A surprising 39% of them are missing one or more important security headers.

Essential Security Headers Every Website Needs

Strict-Transport-Security (HSTS)

What it does: Forces browsers to always use HTTPS, preventing downgrade attacks and SSL stripping.

Risk without it: Without HSTS, attackers can intercept traffic using man-in-the-middle attacks on insecure connections.

How to add it:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Content-Security-Policy (CSP)

What it does: Controls which resources the browser is allowed to load, preventing XSS and data injection attacks.

Risk without it: Without CSP, your website is vulnerable to cross-site scripting (XSS) attacks.

How to add it:

Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'

X-Frame-Options

What it does: Prevents your website from being loaded in an iframe, stopping clickjacking attacks.

Risk without it: Attackers can overlay invisible iframes on your site to trick users into clicking hidden buttons.

How to add it:

X-Frame-Options: SAMEORIGIN

X-Content-Type-Options

What it does: Prevents browsers from MIME-sniffing, reducing drive-by download attacks.

Risk without it: Browsers may misinterpret files and execute malicious code disguised as images or other content.

How to add it:

X-Content-Type-Options: nosniff

Permissions-Policy

What it does: Controls which browser features (camera, microphone, geolocation) your site can access.

Risk without it: Third-party scripts embedded on your site could access sensitive device features without user knowledge.

How to add it:

Permissions-Policy: camera=(), microphone=(), geolocation=()

Referrer-Policy

What it does: Controls how much referrer information is sent when navigating away from your site.

Risk without it: Sensitive URL parameters and paths can leak to third-party sites through referrer headers.

How to add it:

Referrer-Policy: strict-origin-when-cross-origin

Check Your Website’s Security Headers

Not sure which headers your website is missing? Run a free security scan with TrustedWeb to find out exactly what needs to be fixed.

How to Add Security Headers

For Apache, add to your .htaccess file:

Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
Header set Referrer-Policy "strict-origin-when-cross-origin"
Header set Permissions-Policy "camera=(), microphone=(), geolocation=()"

For Nginx, add to your server block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

After adding headers, scan your website again to verify they’re working correctly.