Security · NinjaOps Guides

The 6 Security Headers Every Public Site Needs

CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy. Five minutes of headers buys protection against injection, clickjacking, and mime confusion — and trust signals that come free.

How to fix it

  1. Content-Security-Policy: start permissive (unsafe-inline) and tighten.
  2. X-Content-Type-Options: nosniff — stop browsers guessing file types.
  3. X-Frame-Options: SAMEORIGIN or CSP frame-ancestors 'none'.
  4. Referrer-Policy: strict-origin-when-cross-origin — good privacy default.
  5. Permissions-Policy: disable cameras/mic/geo you don't use.
  6. Test with the grader — it checks all six.

Diagnose this exact issue on your site — free

The 100-Point Affiliate Site Grader runs this check (and 40+ more) on your live site in ~10 seconds. No signup.

Want it fixed for you?

The Zero-Overhead Affiliate Playbook walks through every gap in this guide in 14 days on a $0 stack. Join the launch list →

More Security fixes: