Security header fix guides
Last updated · Reviewed by a CISSP-certified security practitioner
Pick a header and your stack to get copy-paste config, verification steps and common mistakes. 99 guides covering 9 headers across 11 platforms.
Strict-Transport-Security
Forces browsers to only use HTTPS for your domain.
Content-Security-Policy
Controls which scripts, styles and frames a page may load.
X-Content-Type-Options
Stops browsers from guessing (sniffing) file types.
X-Frame-Options
Prevents your site being embedded in iframes (clickjacking).
Referrer-Policy
Limits how much of your URLs leak to other sites.
Permissions-Policy
Turns off browser features (camera, mic, geolocation) you don't use.
Cross-Origin-Opener-Policy
Isolates your window from pop-ups and openers on other sites.
Cross-Origin-Resource-Policy
Stops other sites from loading your resources.
Cross-Origin-Embedder-Policy
Requires embedded resources to opt in (enables cross-origin isolation).