devsecurity
Sign in

HTTP security headers checklist: HSTS, CSP and more

Updated

Security headers tell browsers how to treat your site. They are hardening measures: a missing header is a recommendation, not a CVE.

The headers that matter

Strict-Transport-Security: forces HTTPS on return visits. A common value is max-age=31536000; includeSubDomains.

Content-Security-Policy: limits where scripts and resources may load from, the strongest browser-side defence against cross-site scripting. Start in report-only mode, then enforce.

X-Content-Type-Options: nosniff stops browsers guessing file types.

Clickjacking protection: Content-Security-Policy: frame-ancestors 'self' (X-Frame-Options: SAMEORIGIN is the older equivalent).

Referrer-Policy: strict-origin-when-cross-origin limits what is shared with other sites.

Permissions-Policy: switch off browser features you do not use, for example camera=(), microphone=(), geolocation=().

Cookies: set Secure, HttpOnly and SameSite on session cookies.

nginx example

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self'" always;

Adjust the Content-Security-Policy to the scripts, styles and images your site actually loads before enforcing it.

Apache example

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

Check your headers

curl -sI https://example.com

Run a devsecurity scan to see every header check with evidence, clearly labelled as hardening recommendations.

Frequently asked questions

Is a missing security header a vulnerability?

It is a hardening gap, not a known vulnerability. It makes some attacks easier, but it does not by itself have a CVE.

Which security header matters most?

A well-tuned Content-Security-Policy gives the most protection against cross-site scripting, and HSTS protects against HTTPS downgrade. Both take care to deploy.

Related guides