Security headers for forums: CSP, HSTS and the rest

Forums accept text, links, images and sometimes HTML from strangers, which makes them a natural target for cross-site scripting and clickjacking. A few HTTP response headers add a second layer of defense on top of your forum software's filtering. Here's what each does and how to add them without breaking logins, embeds or ads.

Key takeaways

Content-Security-Policy limits which scripts and resources a page can load; test it in report-only mode first.
HSTS forces HTTPS; start with a short max-age, because a long one can lock users out if your certificate breaks.
Add nosniff, a Referrer-Policy, and frame-ancestors (or X-Frame-Options) to block clickjacking.

Content-Security-Policy (CSP)

According to MDN: Content Security Policy (CSP), CSP is a set of instructions from a site to the browser restricting what the page's code can do; "the primary use case for CSP is to control which resources, in particular JavaScript resources, a document is allowed to load," mainly as a defense against cross-site scripting. Forums usually load scripts from several places (the forum itself, a CDN, analytics, ads, video embeds), so a strict policy can break things.

Roll it out in report-only mode. MDN explains that with the Content-Security-Policy-Report-Only header, "the policy is not enforced, but any violations are sent to the reporting endpoint." Run it for a week, see what would have been blocked, add the sources you trust, then switch to the enforcing header. Note that report-only can't be set in a <meta> tag; it has to be a real header.

Strict-Transport-Security (HSTS)

HSTS tells browsers to use HTTPS only. Per MDN: Strict-Transport-Security, max-age is how many seconds the browser remembers that, includeSubDomains extends it to every subdomain, and preload requires a max-age of at least 31,536,000 (one year) plus includeSubDomains. The OWASP HTTP Headers Cheat Sheet recommends max-age=63072000; includeSubDomains; preload, but warns that if HSTS is misconfigured or your certificate expires or is revoked, legitimate users may be unable to reach the site. For a small forum: start with a day or a week, confirm auto-renewal works, then raise it.

The quick wins

X-Content-Type-Options: nosniff: OWASP says it blocks MIME-type sniffing that can turn non-executable files into executable ones. Important if members upload attachments.
Referrer-Policy: strict-origin-when-cross-origin: OWASP recommends setting it explicitly rather than relying on browser defaults, so outbound links don't leak full thread URLs.
Clickjacking protection: CSP's frame-ancestors directive replaces X-Frame-Options in supporting browsers; X-Frame-Options: DENY still helps older ones. Use SAMEORIGIN if your own site frames pages.
X-XSS-Protection: OWASP says don't set it or set it to 0, because it can create vulnerabilities; use CSP instead.
Remove X-Powered-By: OWASP recommends removing headers that reveal your server stack.

Where to set them

On Apache shared hosting, headers usually go in .htaccess with Header always set lines (requires mod_headers). On Nginx, use add_header in the server block. Back up the file first (see backing up your forum), change one header at a time, and test logins, posting, attachments and embeds after each change. Check what your site actually sends with your browser's developer tools (Network tab). For speed side effects, see forum speed optimization.

Published October 29, 2026. We do not use affiliate links on this page; see our Affiliate Disclosure.