Security header glossary
Last updated · Reviewed by a CISSP-certified security practitioner
- Clickjacking
- Tricking users into clicking something on your site while it's hidden inside an attacker's page via an iframe.
- Cross-site scripting (XSS)
- Injecting malicious JavaScript into pages viewed by other users. CSP is the primary header-level defence.
- CSP nonce
- A random per-response token added to allowed <script> tags so only those inline scripts run.
- Report-Only
- A CSP mode that reports violations without blocking them — the safe way to roll out a policy.
- HSTS preload list
- A list built into browsers of domains that must always use HTTPS. Joining is easy; leaving takes months.
- MIME sniffing
- When a browser guesses a file's type from its contents instead of trusting Content-Type.
- SSL stripping
- A downgrade attack that keeps a victim on HTTP while the attacker talks HTTPS to the real site.
- Magecart
- Attacks that inject card-skimming JavaScript into checkout pages — the threat PCI DSS 6.4.3 and 11.6.1 target.
- Cross-origin isolation
- A browser state enabled by COOP + COEP that unlocks powerful APIs while blocking cross-origin data leaks.
- SSRF
- Server-side request forgery: abusing a server to fetch internal addresses. Our scanner blocks private IPs to prevent it.
- Information leakage headers
- Headers like Server, X-Powered-By and X-AspNet-Version that reveal software versions to attackers.
- SameSite cookie
- A cookie attribute that limits when cookies are sent on cross-site requests, mitigating CSRF.