---
title: Five new guides on the security headers most sites are missing
description: "Add a Content-Security-Policy" is easy advice to give and hard to act on if nobody ever explained what one is. There are now full guides for the five headers…
canonical: https://watchfor.io/changelog/2026-09-08-security-header-guides
---

[All updates](/changelog/page/3#2026-09-08-security-header-guides) ✨ New Sep 8, 2026 · v 7.0.5

# Five new guides on the security headers most sites are missing

"Add a Content-Security-Policy" is easy advice to give and hard to act on if nobody ever explained what one is. There are now full guides for the five headers the website checker flags most often — CSP, clickjacking, MIME sniffing, Referrer-Policy and Permissions-Policy — each covering what the header does, what actually goes wrong without it, and how to roll it out without breaking a working site. The audit links straight to them from the finding.

## The five guides

- [Content-Security-Policy](/blog/content-security-policy-explained): how third-party code ends up on your page, the few directives worth knowing, and how to roll a policy out in report-only mode first, so it never breaks the site.

- [Clickjacking](/blog/clickjacking-explained): how an invisible frame steals a click, and the one-line fix with X-Frame-Options or frame-ancestors .

- [MIME sniffing](/blog/mime-sniffing-explained): why a browser may guess that an uploaded file is a script, and what X-Content-Type-Options: nosniff changes.

- [Referrer-Policy](/blog/referrer-policy-explained): what every outbound link tells other sites, including reset tokens in a URL, and whether a stricter policy breaks your analytics.

- [Permissions-Policy](/blog/permissions-policy-explained): switching off the camera, microphone and other browser features your site never uses.

## An example

You run the [Smart Website Checker](/smart-website-audit) on your shop and it flags a missing Referrer-Policy. Before, that was all you got. Now the finding links to the guide, which shows how a password-reset link with ?token= in it can reach a third-party script while the token is still valid, gives you the header line to add, and lists what to check afterwards.

## Each guide covers

- What the header does, in plain words.

- What actually goes wrong without it, with a real-looking case rather than a theory.

- What could break when you add it, and how to avoid that.

- How to keep it in place after the next deploy.

The [security headers checker](/security-headers-checker) shows which of these your site sends today.

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-09-08-security-header-guides · Site guide: https://watchfor.io/llms.txt