---
title: "Using HTTP Headers to Secure Your Site"
description: "A straightforward Static Buildpack app received an F, scoring 20/100 in Mozilla Observatory because several security response headers were missing, despite redirecting visitors to HTTPS with an Automated Certificate Management certificate. The walkthrough examines failures for Content Security Policy, HTTP Strict Transport Security, X-Content-Type-Options, X-Frame-Options and X-XSS-Protection, then configures them through the static.json headers collection. The CSP restricts resource origins, blocks inline scripts by default, and uses a SHA-256 hash to permit the Google Analytics inline script without adding unsafe-inline. HSTS uses max-age=63072000, includeSubDomains and optionally preload, while other headers supply MIME sniffing, iframe and legacy XSS protections. After the changes, the reported checks pass, the configuration reaches an A and is later described as A+; the final recommendation adds Referrer-Policy and omits opt-in HSTS preload."
---

# Using HTTP Headers to Secure Your Site

[Heroku](https://yomu.fyi/company/heroku) · Caleb Hearth · Mar 1, 2018

**Type:** Tutorial

## Summary

A straightforward Static Buildpack app received an F, scoring 20/100 in Mozilla Observatory because several security response headers were missing, despite redirecting visitors to HTTPS with an Automated Certificate Management certificate. The walkthrough examines failures for Content Security Policy, HTTP Strict Transport Security, X-Content-Type-Options, X-Frame-Options and X-XSS-Protection, then configures them through the static.json headers collection. The CSP restricts resource origins, blocks inline scripts by default, and uses a SHA-256 hash to permit the Google Analytics inline script without adding unsafe-inline. HSTS uses max-age=63072000, includeSubDomains and optionally preload, while other headers supply MIME sniffing, iframe and legacy XSS protections. After the changes, the reported checks pass, the configuration reaches an A and is later described as A+; the final recommendation adds Referrer-Policy and omits opt-in HSTS preload.

## Context

The site initially scored 20/100, or F, because Mozilla Observatory found that several security headers were not implemented. The post uses this result to address missing protections while noting that the site already redirected to HTTPS and had an SSL certificate through Heroku's Automated Certificate Management.

## Approach / What changed

The configuration adds security headers to every path through the static.json headers collection. It defines a source-restricting Content-Security-Policy, permits a required inline Google Analytics script with a SHA-256 hash, sets HSTS, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, and adds a Referrer-Policy in the final recommendation.

## Takeaways

- A Content-Security-Policy can allow required external fonts, images, and analytics sources while retaining default self-hosting restrictions and frame-ancestors 'none'.
- The inline Google Analytics script is authorized with a specific SHA-256 hash instead of the less secure 'unsafe-inline' directive; changing the script requires updating the hash.
- The recommended final headers include HSTS with max-age=63072000 and includeSubDomains, plus nosniff, DENY, XSS blocking, and a Referrer-Policy; HSTS preload is excluded as opt-in.

**Tags:** [Content Security Policy](https://yomu.fyi/topic/content-security-policy), [Security](https://yomu.fyi/topic/security)

- Source: [Heroku](https://www.heroku.com/blog/using-http-headers-to-secure-your-site)
- Source URL: https://www.heroku.com/blog/using-http-headers-to-secure-your-site
- Ingested by Yomu: 2026-09-09T14:25:55.327Z

[Read original post](https://www.heroku.com/blog/using-http-headers-to-secure-your-site)