Skip to content
uencoder

Security Header

Security HTTP headers are response headers instructing the browser to enable security mechanisms, such as CSP, HSTS, and X-Frame-Options.

Purpose

To declare security policies via HTTP headers so the browser enables protections automatically, reducing the burden of code-level defense.

Mechanism

Key headers: Content-Security-Policy (XSS defense), Strict-Transport-Security (HSTS), X-Frame-Options (clickjacking), X-Content-Type-Options: nosniff (MIME sniffing), Referrer-Policy (referrer leakage), Permissions-Policy (API permissions).

Use cases

  • Web app security hardening
  • XSS and clickjacking defense
  • HTTPS enforcement
  • Security compliance

Examples

  • Input 
    Content-Security-Policy: default-src 'self'
    Output 
    Restricts resource sources

    CSP header

Common errors

Missing key security headers
Scan with securityheaders.com and fill the gaps

Related terms

CSP
CSP (Content Security Policy) declares, via an HTTP header, which resource origins a page may load, shrinking the attack surface for XSS and data injection.
GLOSSARY
HSTS
HSTS (HTTP Strict Transport Security) declares via an HTTP header that a site is reachable only over HTTPS, preventing SSL stripping and downgrade attacks.
GLOSSARY
CORS
CORS (Cross-Origin Resource Sharing) is a browser security mechanism that uses HTTP headers to control whether a page may access resources from a different origin, preventing cross-site reads.
GLOSSARY
Clickjacking
Clickjacking is an attack that overlays a decoy page with a transparent iframe so the victim unknowingly clicks buttons on the target site.
GLOSSARY

References