Essential HTTP Security Headers

Why Security Headers Matter

Security headers are your first line of defense against common web attacks. They're free, easy to implement, and protect against XSS, clickjacking, and downgrade attacks.

The Essential Headers

Strict-Transport-Security (HSTS)

Forces browsers to use HTTPS for all future requests.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Content-Security-Policy (CSP)

Controls which resources the browser can load. Prevents XSS attacks.

Content-Security-Policy: default-src 'self'; script-src 'self' cdn.example.com

X-Content-Type-Options

Prevents MIME type sniffing.

X-Content-Type-Options: nosniff

X-Frame-Options

Prevents clickjacking by controlling iframe embedding.

X-Frame-Options: DENY

Referrer-Policy

Controls how much referrer information is sent with requests.

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy

Controls which browser features the page can use.

Permissions-Policy: camera=(), microphone=(), geolocation=()

Testing Your Headers

Use the Header Checker tool on this site to analyze any URL's security headers. You can also check securityheaders.com for a grade.