How do I decide which headers to use and their values?

Start with common, low-risk defaults (X-Content-Type-Options, Referrer-Policy). Roll out stricter policies like CSP gradually and test thoroughly.

🥳 Celebrate Our Launch With a $200 LIFETIME Discount OFF The Premium Plan Use: BIRTHDAY2024

This offer expires 9/30/2024, at 11:59 PM EST

BizStackPro all-in-one digital marketing platform dashboard.

Security Headers for Funnels & Websites – BizStackPro Guide

Security Headers for Funnels & Websites

Q: What are custom security headers?

Custom security headers are HTTP headers you configure to enhance the security of your funnels and websites. They instruct the browser on how to handle security aspects, helping protect against vulnerabilities and attacks.

Q: Why should I use custom security headers?

Custom security headers add an extra layer of protection by specifying browser behavior. They mitigate risks like cross-site scripting (XSS), clickjacking, and other threats.

Q: How do I access the security settings to add custom headers?

Navigate to Sites > Funnels (or Websites) > choose your asset > Settings > Security tab. Click Add New Security Header.

Q: What information do I need when adding a header?

Provide the Header Name (e.g., Content-Security-Policy) and the Header Value (e.g., default-src 'self').

Q: How are headers applied?

After you save, the headers are sent with page responses and enforced by the browser on load.

Reduce common web risks with HTTP security headers. Add CSP, HSTS, frame protections, and more—safely and systematically.

Browse Help Center See All Plans & Features

Protecting Your Pages Without Breaking Functionality

You may have your funnels and websites live, but without proper security controls, they can be exposed to common web risks.

Security headers tell browsers how to handle your content, helping prevent issues like cross-site scripting and clickjacking.

Without the right setup, your pages may be more vulnerable—or overly strict settings could break important features.

This guide will show you how to apply security headers carefully so you can improve protection without disrupting your pages.

Once you understand how security headers work, follow the steps below to configure, test, and safely apply them inside your BizStackPro funnels and websites.

Configure Security Headers

Security headers are browser instructions sent with every page response. They help block common attacks like cross-site scripting (XSS), clickjacking, and risky resource loading.

Open Security: Sites → Funnels (or Websites) → choose asset → Settings → Security
Add Header: Click Add New Security Header
Name & Value: Enter the Header Name and Header Value
Save & Test: Preview, then test live in an incognito window and multiple browsers

Follow along: Add one header at a time and test after each change. If something breaks, remove the last header or loosen the policy, then re-test.

Why This Matters

Protection: Reduce XSS, clickjacking, MIME sniffing, and downgrade risks.
Control: Limit which domains can load scripts, images, fonts, and frames.
Trust: Clean security posture helps prevent issues that damage conversions and deliverability.

Pro tip: Start with “safe defaults” first, then roll out CSP gradually. CSP is powerful—but it’s also the easiest header to break things if you go too strict too fast.

Starter Header Set (Safe Defaults)

These are commonly used, low-risk headers you can apply first. Adjust based on your page features (embeds, iframes, analytics, etc.).

1) X-Content-Type-Options

Value: nosniff

Helps prevent MIME-type sniffing.

2) Referrer-Policy

Value: strict-origin-when-cross-origin

Limits how much referrer info is shared to other sites.

3) Permissions-Policy

Value: camera=(), geolocation=(), microphone=()

Disables powerful browser features you likely don’t need on funnels.

4) X-Frame-Options

Value: DENY

Blocks your page from being embedded in an iframe (reduces clickjacking).

If you need embedding, you may need a different approach (often CSP frame-ancestors).

5) Strict-Transport-Security (HSTS)

Value: max-age=15552000; includeSubDomains

Forces HTTPS for ~180 days. Add preload only after careful testing.

6) Content-Security-Policy (CSP)

Value (starter): default-src 'self'

A baseline policy. If you load assets from CDNs (fonts, analytics, videos), you must explicitly allow those hosts.

Rolling Out CSP Safely

Start in report-only: Use Content-Security-Policy-Report-Only first so nothing is blocked.
Review what loads: Check DevTools for violations and list the domains you actually need.
Whitelist only required hosts: Add only the CDNs/APIs you use (fonts, images, analytics, embeds).
Enforce gradually: Once the report-only logs look clean, switch to enforced CSP.

Follow along: If your page uses third-party widgets (chat, calendars, video embeds), CSP will need to allow those domains—or the widget may stop working.

Want to harden your pages without breaking them?

Start with safe defaults, test quickly, then tighten CSP step-by-step once you know exactly what your pages load.

🚀 See All Plans & Features

Opens in a new tab.

Frequently Asked Questions

What are custom security headers?

They’re HTTP headers that tell the browser how to safely load and handle your pages.

Why should I use custom security headers?

They reduce risks like XSS, clickjacking, and unsafe resource loading—often with minimal visual impact.

How do I access the security settings to add custom headers?

Go to Sites → Funnels (or Websites) → select your asset → Settings → Security.

What information do I need when adding a header?

A Header Name and a Header Value (for example: Referrer-Policy + strict-origin-when-cross-origin).

How do I decide which headers to use?

Start with safe defaults (like nosniff + referrer policy), then roll CSP out gradually using report-only mode.

How are headers applied?

Once saved, headers are sent with your page response and enforced by the browser on load.

📚 Browse More Help Guides

Secure Pages, Confident Launches

Add safe headers first, test quickly, then tighten CSP once you know exactly what your funnels and websites need to load. The result: stronger protection without broken embeds or missing assets.

✅ View Plans & Features

Safer pages. Same smooth UX.

📚 Browse More Help Guides

Disclaimer: This site is NOT endorsed by Google, Facebook or YouTube in ANY WAY. All trademarks & Logo / branding are the property of their respective owners. Please Note: This site was created in BizStackPro by Ken George II (An Affiliate of BizStackPro) and may contain affiliate links.