HTTP security headers explained
Last updated · Reviewed by a CISSP-certified security practitioner
Security headers are instructions your server sends with every response telling browsers how to protect your users. These 9 headers cover HTTPS enforcement, script control, clickjacking, privacy and cross-origin isolation.
| Header | What it does | Safe value |
|---|---|---|
| Strict-Transport-Security | Forces browsers to only use HTTPS for your domain. | max-age=63072000; includeSubDomains; pre… |
| Content-Security-Policy | Controls which scripts, styles and frames a page may load. | default-src 'self'; script-src 'self'; s… |
| X-Content-Type-Options | Stops browsers from guessing (sniffing) file types. | nosniff |
| X-Frame-Options | Prevents your site being embedded in iframes (clickjacking). | DENY |
| Referrer-Policy | Limits how much of your URLs leak to other sites. | strict-origin-when-cross-origin |
| Permissions-Policy | Turns off browser features (camera, mic, geolocation) you don't use. | camera=(), microphone=(), geolocation=()… |
| Cross-Origin-Opener-Policy | Isolates your window from pop-ups and openers on other sites. | same-origin |
| Cross-Origin-Resource-Policy | Stops other sites from loading your resources. | same-origin |
| Cross-Origin-Embedder-Policy | Requires embedded resources to opt in (enables cross-origin isolation). | require-corp |