Security header reference
What each header actually prevents, and the mistake each one invites.
| Header | Purpose | Recommended value |
|---|---|---|
| Content-Security-Policy | Controls which sources the browser will load and execute content from. The single most effective defence against cross-site scripting. | default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'self' |
| Strict-Transport-Security | Tells browsers to use https for this domain and refuse to fall back, even if the user types http or follows a plain link. | max-age=31536000; includeSubDomains |
| X-Frame-Options | Stops other sites embedding your pages in a frame. Superseded by CSP frame-ancestors, but still worth setting for old browsers. | DENY |
| X-Content-Type-Options | Stops browsers second-guessing the declared Content-Type of a response. | nosniff |
| Referrer-Policy | Controls how much of the current URL is sent to sites you link to or load resources from. | strict-origin-when-cross-origin |
| Permissions-Policy | Declares which browser features your page and its embedded frames may use. | camera=(), microphone=(), geolocation=() |
| Cross-Origin-Opener-Policy | Separates your pages from windows that opened them, or that they open. | same-origin |
| Cross-Origin-Embedder-Policy | Requires that every cross-origin resource explicitly opts in to being embedded. | require-corp |
| Cross-Origin-Resource-Policy | Declares who may embed this resource, blocking speculative cross-origin reads. | same-origin |
| X-XSS-Protection | A legacy header that should now be disabled or removed. Enabling it is worse than leaving it off. | 0 |
| Server and X-Powered-By | Headers that advertise exactly which software and version you run. | (remove, or strip the version) |
| Access-Control-Allow-Origin | Declares which origins may read responses from this endpoint. The dangerous mistake here is reflecting the request origin. | (only where cross-origin reads are intended) |