HTTP Security Headers
HTTP response headers are how a server tells the browser how to treat a page — which scripts may run, whether the connection must be HTTPS, who may embed the content, and how cookies and caches behave. Set them well and an entire class of attacks disappears; set them poorly and a single missing line can expose users.
This section documents every major security and behaviour header: what it does, its correct syntax, at least one real example, the misconfigurations that bite in production, and how WebInspect grades it.
- Content-Security-PolicyThe single most effective defense against cross-site scripting: a policy that tells the browser exactly which sources of scripts, styles, images and other resources are allowed to load.
- Strict-Transport-SecurityTells the browser to remember that this site is HTTPS-only, so it upgrades every future request to TLS automatically and refuses to connect over plain HTTP.
- X-Frame-OptionsStops other sites from embedding your pages in an invisible frame to trick users into clicking — the classic defense against clickjacking.
- X-Content-Type-OptionsOne value — nosniff — that stops the browser from guessing a file's type and running, say, an uploaded image as JavaScript.
- Referrer-PolicyControls how much of the current URL leaks to other sites in the Referer header when users click links or the page loads cross-origin resources.
- Permissions-PolicyDecides which powerful browser features — camera, microphone, geolocation, payment — a page and its embedded iframes are even allowed to request.
- Cross-Origin-Opener-PolicyCuts the scripting link between your page and any cross-origin window that opened it, blocking a class of cross-site information leaks.
- Cross-Origin-Embedder-PolicyRequires every cross-origin resource your page loads to explicitly opt in, which — paired with COOP — makes the page cross-origin isolated.
- Cross-Origin-Resource-PolicySet on your assets to declare who is allowed to embed them, protecting resources from being pulled into other sites and read via side-channels.
- X-XSS-ProtectionA legacy toggle for old browsers' built-in XSS filters. Modern browsers have removed those filters — the header is deprecated and should be replaced by CSP.
- Cache-ControlThe master switch for caching: how long a response can be reused, whether shared caches may store it, and when it must be revalidated — with real security implications.
- Set-CookieStores cookies in the browser — and its Secure, HttpOnly and SameSite attributes are what stand between a session cookie and theft or CSRF.
- Access-Control-Allow-OriginThe core CORS header that decides which other origins are allowed to read your API responses from the browser — get the wildcard-plus-credentials combo wrong and you leak data.
- Content-TypeDeclares what a response actually is — HTML, JSON, an image — and its character encoding. A wrong or missing value causes both rendering bugs and real security issues.