HeaderAudit

Security header reference

What each header actually prevents, and the mistake each one invites.

HeaderPurposeRecommended value
Content-Security-Policy Controls which sources the browser will load and execute content from. The single most effective defence against cross-site scripting. default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'self'
Strict-Transport-Security Tells browsers to use https for this domain and refuse to fall back, even if the user types http or follows a plain link. max-age=31536000; includeSubDomains
X-Frame-Options Stops other sites embedding your pages in a frame. Superseded by CSP frame-ancestors, but still worth setting for old browsers. DENY
X-Content-Type-Options Stops browsers second-guessing the declared Content-Type of a response. nosniff
Referrer-Policy Controls how much of the current URL is sent to sites you link to or load resources from. strict-origin-when-cross-origin
Permissions-Policy Declares which browser features your page and its embedded frames may use. camera=(), microphone=(), geolocation=()
Cross-Origin-Opener-Policy Separates your pages from windows that opened them, or that they open. same-origin
Cross-Origin-Embedder-Policy Requires that every cross-origin resource explicitly opts in to being embedded. require-corp
Cross-Origin-Resource-Policy Declares who may embed this resource, blocking speculative cross-origin reads. same-origin
X-XSS-Protection A legacy header that should now be disabled or removed. Enabling it is worse than leaving it off. 0
Server and X-Powered-By Headers that advertise exactly which software and version you run. (remove, or strip the version)
Access-Control-Allow-Origin Declares which origins may read responses from this endpoint. The dangerous mistake here is reflecting the request origin. (only where cross-origin reads are intended)

The order worth doing them in →