Ennuilabs

Lightweight Security Headers for Static Sites

Feb 9, 2026 · Web

Small headers, meaningful protection

Even static sites benefit from a few well-chosen security headers. Start simple, then tighten over time.

The most impactful header for modern sites is Content Security Policy (CSP). It limits where scripts, styles, and other resources can load from. OWASP recommends starting with a restrictive policy and using Report-Only mode to test. Even a minimal CSP helps reduce the blast radius of script injection.

If you can’t set headers directly (some static hosts are limited), you can still use a CSP meta tag for basic control. It’s not as strong as an HTTP header, but it’s a reasonable improvement for simple sites.

For a static marketing site, start with a CSP that allows only your own origin. Add specific third-party domains as needed.

Other small wins include setting a strict Referrer-Policy and disabling MIME sniffing with X-Content-Type-Options. Together these reduce data leakage and make browsers behave predictably.

References