Mohamed Sharaf
Menu
Security

Security headers in an afternoon

Six response headers, copy-paste values, and the one to roll out slowly.

· 1 min read

Six headers, added once at the server or CDN. They block clickjacking, HTTPS downgrades, content sniffing and a lot of XSS. Start with these:

Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'

The first five rarely break anything. Two notes:

  • Only add includeSubDomains to HSTS if every subdomain serves HTTPS. Be careful with preload; leaving the list is slow.
  • CSP is the strong one and the one that breaks pages. Ship it as Content-Security-Policy-Report-Only first, watch what it would block for a week, fix, then enforce. No 'unsafe-inline' for scripts; use hashes or nonces.

Also remove X-XSS-Protection (browsers dropped it) and the version numbers in Server and X-Powered-By.

Check the result in your browser’s developer tools, then test login and payments before you call it done.

ShareWhatsAppLinkedInXTelegramFacebook