HTTP Security Headers

Security headers

Response headers that instruct the browser to enforce security policies, reduce attack surface, and limit information disclosure.

Transport security

• Strict-Transport-Security (HSTS) — tells the browser to use HTTPS for future requests to the site. Example: max-age=31536000; includeSubDomains. Only use includeSubDomains when all subdomains support HTTPS.

Content and injection protection

• Content-Security-Policy (CSP) — restricts which scripts, styles, images, frames, and other resources the browser may load or execute. It is an important defence-in-depth control against XSS. Modern CSPs commonly use nonces or hashes rather than broad allowlists.

• X-Content-Type-Options — nosniff prevents MIME-type sniffing and makes the browser respect the declared Content-Type.

Clickjacking

• X-Frame-Options — controls whether a page can be embedded in a frame. DENY prevents framing entirely; SAMEORIGIN permits framing only by the same origin. CSP frame-ancestors is the more flexible modern mechanism.

Cross-origin isolation

• Cross-Origin-Opener-Policy (COOP) — controls whether a document can share a browsing context group with documents from other origins.

• Cross-Origin-Resource-Policy (CORP) — controls which origins may load a resource.

• Cross-Origin-Embedder-Policy (COEP) — controls whether a document may load cross-origin resources that have not explicitly opted into being embedded.

Privacy and browser capabilities

• Referrer-Policy — controls how much referrer information the browser sends in the Referer header. A common restrictive choice is strict-origin-when-cross-origin.

• Permissions-Policy — controls which browser features and APIs, such as camera and geolocation, a document and its frames may use.

Information disclosure

• Server — may reveal the web-server software and version. Removing or generalising it reduces information disclosure, but does not itself fix vulnerabilities.

• X-Powered-By — may reveal the application framework or runtime, such as PHP or ASP.NET. Usually best removed.

Cookies

Cookie security is also controlled by response headers:

• Secure — sends the cookie only over HTTPS.
• HttpOnly — prevents JavaScript from accessing the cookie.
• SameSite — controls when the browser sends the cookie in cross-site requests and helps mitigate CSRF.

Reference

securityheaders.com