HTTP response headers let a server tell the browser how to handle transport, content types, referrers, permissions and embedding. They are useful only when they are present in the actual response.
GuideBest practicesBeginner
HTTP security headers: which ones to enable and why
Understand HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy and how to verify the headers actually returned.
Show contents
HSTS and HTTPS
Strict-Transport-Security asks browsers to use HTTPS for a period after a secure visit. Enable it only after HTTPS is reliable across the intended hostnames; a long max-age is a commitment.
Prevent content-type guessing
X-Content-Type-Options: nosniff tells browsers not to reinterpret declared MIME types. Correct Content-Type values still matter.
Control referrer information
Referrer-Policy limits how much URL information is sent when navigating or loading resources. A balanced policy can reduce accidental leakage without breaking useful origin information.
Restrict browser capabilities
Permissions-Policy can limit access to features such as camera, microphone or geolocation. Grant only capabilities the application actually needs.
CSP belongs in the same review
Content Security Policy is also an HTTP security header, but it is complex enough to deserve its own CSP guide. Avoid obsolete headers presented as universal modern protection.
Use the security headers generator, HTTP header analyzer and HTTP header builder, then verify the final production response rather than trusting an intermediate configuration.