A practical guide to six HTTP security headers every website should send: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Each header is explained with what attack it prevents and a ready-to-use value. A complete starter block is provided along with tips on how to verify headers using curl, how to avoid leaking server version info, and where to configure headers (nginx, Cloudflare Pages, Express/Helmet).
Table of contents
Strict-Transport-Security (HSTS)Content-Security-Policy (CSP)X-Content-Type-OptionsX-Frame-Options and frame-ancestorsReferrer-PolicyPermissions-PolicyA starter block you can copyHow to check your own siteWhere to set these35 Impressions