What are HTTP security headers?

HTTP security headers are response headers that instruct browsers to enable security features. Key headers include Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, and X-Content-Type-Options.

What is Content-Security-Policy (CSP)?

CSP is an HTTP header that tells browsers which sources of content are trusted. It prevents XSS attacks by blocking inline scripts and restricting where scripts, styles, and other resources can be loaded from.

How do I check my security headers?

Use securityheaders.com to scan your website and get a grade from A+ to F. It checks for all major security headers and provides remediation guidance for missing or misconfigured headers.

HTTP Security Headers Checklist & Implementation Guide

By FixTheVuln Team Peer-reviewed security content Sources: CISA, NVD, OWASP

Why Security Headers Matter: HTTP security headers tell browsers how to behave when handling your site's content, providing crucial protection against common attacks like XSS, clickjacking, and data injection.

Essential Security Headers

Content-Security-Policy (CSP)

Protection Against: XSS, data injection attacks, malicious script execution

Priority: Critical

What It Does:

Controls which resources the browser is allowed to load, preventing execution of malicious scripts.

Basic Implementation:

                    Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:;
                

Recommended Starter Policy:

                    Content-Security-Policy: 
    default-src 'self';
    script-src 'self' 'unsafe-inline' 'unsafe-eval';
    style-src 'self' 'unsafe-inline';
    img-src 'self' data: https:;
    font-src 'self' data:;
    connect-src 'self';
    frame-ancestors 'none';
                

Server Configuration:

                    # Apache (.htaccess or httpd.conf)
Header set Content-Security-Policy "default-src 'self'"

# Nginx
add_header Content-Security-Policy "default-src 'self'";

# Express.js
app.use((req, res, next) => {
    res.setHeader("Content-Security-Policy", "default-src 'self'");
    next();
});
                

Note: Start with report-only mode to avoid breaking functionality:
Content-Security-Policy-Report-Only

See detailed CSP guide →

Key Takeaways

Content-Security-Policy (CSP) is the most important header — it prevents XSS attacks
Enable HSTS to force HTTPS and prevent protocol downgrade attacks
Set X-Content-Type-Options: nosniff to prevent MIME-type sniffing
Use X-Frame-Options: DENY to prevent clickjacking attacks
Test your headers at securityheaders.com — aim for an A+ rating

Strict-Transport-Security (HSTS)

Protection Against: Man-in-the-middle attacks, SSL stripping, protocol downgrade attacks

Priority: Critical

What It Does:

Forces browsers to only connect via HTTPS, never HTTP.

Implementation:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Parameters:

• max-age=31536000 - Cache for 1 year (in seconds)
• includeSubDomains - Apply to all subdomains
• preload - Submit to browser preload list

Server Configuration:

                    # Apache
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# Nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# Express.js
app.use((req, res, next) => {
    res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
    next();
});
                

Important: Only enable after ensuring all content is served over HTTPS. Start with shorter max-age (e.g., 300) for testing.

See detailed HSTS guide →

X-Frame-Options

Protection Against: Clickjacking attacks

Priority: High

What It Does:

Prevents your site from being embedded in frames/iframes on other sites.

Implementation:

X-Frame-Options: DENY

Options:

• DENY - No framing allowed (recommended)
• SAMEORIGIN - Allow framing from same origin only
• ALLOW-FROM uri - Allow from specific URI (deprecated)

Server Configuration:

                    # Apache
Header always set X-Frame-Options "DENY"

# Nginx
add_header X-Frame-Options "DENY" always;

# Express.js
app.use((req, res, next) => {
    res.setHeader("X-Frame-Options", "DENY");
    next();
});
                

Modern Alternative: Use CSP's frame-ancestors 'none' directive for better control.

See detailed clickjacking protection guide →

X-Content-Type-Options

Protection Against: MIME type sniffing attacks

Priority: High

What It Does:

Prevents browsers from MIME-sniffing a response away from the declared content-type.

Implementation:

X-Content-Type-Options: nosniff

Server Configuration:

                    # Apache
Header always set X-Content-Type-Options "nosniff"

# Nginx
add_header X-Content-Type-Options "nosniff" always;

# Express.js
app.use((req, res, next) => {
    res.setHeader("X-Content-Type-Options", "nosniff");
    next();
});
                

See detailed guide →

Referrer-Policy

Protection Against: Information leakage via referrer header

Priority: Medium

What It Does:

Controls how much referrer information is sent with requests.

Recommended Implementation:

Referrer-Policy: strict-origin-when-cross-origin

Options (from most to least restrictive):

• no-referrer - Never send referrer
• same-origin - Send only for same-origin requests
• strict-origin - Send origin only, not on HTTPS→HTTP
• strict-origin-when-cross-origin - Full URL for same-origin, origin only for cross-origin
• unsafe-url - Always send full URL (not recommended)

Server Configuration:

                    # Apache
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Express.js
app.use((req, res, next) => {
    res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
    next();
});
                

See detailed guide →

Permissions-Policy

Protection Against: Unauthorized access to browser features

Priority: Medium

What It Does:

Controls which browser features and APIs can be used (formerly Feature-Policy).

Implementation:

Permissions-Policy: geolocation=(), microphone=(), camera=()

Common Restrictions:

                    Permissions-Policy: 
    geolocation=(), 
    microphone=(), 
    camera=(), 
    payment=(), 
    usb=(), 
    magnetometer=(), 
    gyroscope=(), 
    accelerometer=()
                

Server Configuration:

                    # Apache
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

# Nginx
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
                

See detailed guide →

X-XSS-Protection

Protection Against: Reflected XSS attacks (legacy)

Priority: Low (deprecated in favor of CSP)

Implementation:

X-XSS-Protection: 0

Note: Set to 0 to disable. This header is deprecated and can introduce vulnerabilities. Use Content-Security-Policy instead.

See detailed guide →

Complete Configuration Examples

Apache (.htaccess or httpd.conf)

                    <IfModule mod_headers.c>
    # Content Security Policy
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';"
    
    # Strict Transport Security
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    
    # Prevent clickjacking
    Header always set X-Frame-Options "DENY"
    
    # Prevent MIME sniffing
    Header always set X-Content-Type-Options "nosniff"
    
    # Referrer Policy
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    
    # Permissions Policy
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    
    # Disable XSS Protection (use CSP instead)
    Header always set X-XSS-Protection "0"
</IfModule>
                

Nginx

                    # Add to server or location block
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
add_header X-XSS-Protection "0" always;
                

Express.js (Node.js)

                    const helmet = require('helmet');

// Using Helmet middleware (recommended)
app.use(helmet());

// Or manually:
app.use((req, res, next) => {
    res.setHeader("Content-Security-Policy", "default-src 'self'");
    res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
    res.setHeader("X-Frame-Options", "DENY");
    res.setHeader("X-Content-Type-Options", "nosniff");
    res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
    res.setHeader("Permissions-Policy", "geolocation=(), microphone=(), camera=()");
    next();
});
                

Testing Your Headers

Online Tools:

• SecurityHeaders.com - Comprehensive header scanner
• Mozilla Observatory - Security analysis
• Browser DevTools - Network tab to inspect response headers

Quick Checklist

Header	Priority	Status
Content-Security-Policy	Critical	☐ Implemented
Strict-Transport-Security	Critical	☐ Implemented
X-Frame-Options	High	☐ Implemented
X-Content-Type-Options	High	☐ Implemented
Referrer-Policy	Medium	☐ Implemented
Permissions-Policy	Medium	☐ Implemented

Next Steps: Test your headers at SecurityHeaders.com after implementation. Aim for an A+ rating!

Related Resources

🔒 OWASP Top 10 Critical web security risks 🔐 SSL/TLS Hardening Secure HTTPS configuration 📝 WordPress Security WordPress hardening steps

Test Your Knowledge

Security+ Practice Quiz CySA+ Practice Quiz

Latest from the Blog

ISC2 CCSP Study Guide: Everything You Need to Pass the CCSP Exam

← Back to Tools

FixTheVuln Store

Get the CompTIA Security+ Study Planner

Fillable PDF study planners with domain trackers, weekly schedules, and progress tracking. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.

CompTIA Security+ Planner

60+ certifications available — from $5.99

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

CyberFolio

Choosing your next cert? Track them all in one place.

Build a shareable cybersecurity portfolio that highlights your certifications, projects, and skills — free.

Build Your Portfolio →

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo