HTTP security headers and NCSC guidance for UK organisations
The National Cyber Security Centre (NCSC) publishes specific guidance on HTTP security headers for UK organisations. A correct set of headers blocks the most common web attack vectors: XSS, clickjacking, and protocol downgrade attacks. The GOV.UK platform, served via Fastly CDN, sets a specific header profile that includes HSTS with preloading and a strict Content-Security-Policy. Paste raw headers from DevTools or curl output here to get an immediate plain-English explanation of each directive.
Key security headers and what they do
| Header | Purpose | NCSC recommendation |
|---|---|---|
| Strict-Transport-Security | Forces HTTPS for a set duration (HSTS) | min-age=31536000; includeSubDomains |
| Content-Security-Policy | Restricts script and resource sources (XSS) | Define explicitly; avoid unsafe-inline |
| Referrer-Policy | Controls referrer data sent to third parties | no-referrer or strict-origin |
| X-Frame-Options | Prevents clickjacking via iframes | DENY or SAMEORIGIN |
| Permissions-Policy | Restricts browser feature access (camera, mic) | Disable unused features |
UK GDPR and Referrer-Policy
Referrer-Policy matters for UK GDPR compliance: a lax Referrer-Policy: unsafe-url setting sends the full URL of every page, including URL parameters that may contain personal data, to third-party analytics and advertising services. UK ICO guidance recommends setting Referrer-Policy: strict-origin at minimum to reduce data leakage to third-party scripts, including GA4.
How to access headers for this tool
In Chrome or Firefox: open DevTools (F12), click the Network tab, select any request, then copy the Response Headers section. Alternatively: curl -I https://example.com in a terminal. Paste the output directly into this tool for an explanation of every header present.