HTTP security headers: which ones to enable and why

HTTP response headers let a server tell the browser how to handle transport, content types, referrers, permissions and embedding. They are useful only when they are present in the actual response.

HSTS and HTTPS

Strict-Transport-Security asks browsers to use HTTPS for a period after a secure visit. Enable it only after HTTPS is reliable across the intended hostnames; a long max-age is a commitment.

Prevent content-type guessing

X-Content-Type-Options: nosniff tells browsers not to reinterpret declared MIME types. Correct Content-Type values still matter.

Control referrer information

Referrer-Policy limits how much URL information is sent when navigating or loading resources. A balanced policy can reduce accidental leakage without breaking useful origin information.

Restrict browser capabilities

Permissions-Policy can limit access to features such as camera, microphone or geolocation. Grant only capabilities the application actually needs.

CSP belongs in the same review

Content Security Policy is also an HTTP security header, but it is complex enough to deserve its own CSP guide. Avoid obsolete headers presented as universal modern protection.

Use the security headers generator, HTTP header analyzer and HTTP header builder, then verify the final production response rather than trusting an intermediate configuration.