What Are HTTP Security Headers and How Do You Add Them to Your Website?

HTTP security headers are instructions your website's server sends to a visitor's browser, telling it how to handle your pages safely: whether it can be embedded in another site's frame, what to do if a script tries to load from an unexpected source, and more. Most of them take only a few lines to add, and they work on both cPanel and DirectAdmin hosting since the method is the same on either panel.

What Security Headers Actually Do

A browser follows whatever rules your server sends along with each page. Without security headers, the browser falls back to permissive defaults, which is how some common attacks (like clickjacking, where your site is loaded inside an invisible frame on another page) become possible in the first place. Adding the right headers closes off several of these paths without changing how your site looks or works for a normal visitor.

Headers Worth Adding to Your Website

• X-Content-Type-Options: stops the browser from guessing a file's type based on its content instead of trusting the type your server declared. This blocks a class of attacks where a file disguised as an image is actually run as a script.
• X-Frame-Options: controls whether another website can load your pages inside an <iframe>. Setting this to SAMEORIGIN stops your site from being embedded elsewhere, which protects against clickjacking.
• Referrer-Policy: controls how much information about the page a visitor came from gets passed along when they click a link to leave your site. A stricter setting avoids leaking full URLs (which can include search terms or session details) to other sites.
• Permissions-Policy: lets you switch off browser features your site doesn't use, such as the camera, microphone, or geolocation, so a compromised third-party script embedded on your page can't quietly request access to them.
• Content-Security-Policy (CSP): the strongest of the group. It tells the browser exactly which sources scripts, styles, and images are allowed to load from, which is one of the most effective defenses against a hacked site injecting malicious code.

If your website also needs to force visitors onto HTTPS, that's handled by a separate header called HSTS. See our guide on how to enable HSTS for that one specifically.

How to Add Security Headers to Your Website

For a standard PHP or WordPress site on Apache (which covers most ZIPROF hosting accounts), the easiest way to add these headers is through your site's .htaccess file. The steps are the same whether you're on cPanel or DirectAdmin, since both give you a File Manager to edit the file directly.

1. Open your hosting control panel's File Manager and navigate to public_html (or the folder your website's files are in).
2. Find the .htaccess file. If you don't see it, enable the option to show hidden files in your File Manager settings.
3. Right-click the file and choose Edit (or Code Editor, depending on your panel).
4. Add the following lines near the top of the file, above any existing rewrite rules:

<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
  Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

5. Save the file and reload your website in the browser to confirm nothing looks broken.

Add a Content-Security-Policy header only after testing it carefully. A CSP that's too strict can silently stop your own scripts, fonts, or embedded content (like a YouTube video or payment widget) from loading. Start with a loose policy and tighten it gradually, checking your site after each change, rather than adding a strict one all at once.

If your site runs on WordPress, some SEO or security plugins can add these headers for you through a settings screen instead of editing .htaccess directly, which is a safer option if you're not comfortable editing server files yourself.

How to Check the Headers Are Working

Open your website in a desktop browser, open the developer tools (usually F12), go to the Network tab, reload the page, and click on the main document request. The Response Headers section will list every header your server is sending, so you can confirm the ones you added are actually there.

For more on editing this file in general, see our guide on what a .htaccess file is and what you can do with it.