HTTP Security Headers Reference
Content-Security-Policy, HSTS, X-Frame-Options, and other security response headers.
Content Security Policy
Content-Security-Policy is the most powerful HTTP security header, restricting which resources the browser may load and execute. A policy is a list of directives, each specifying a resource type and allowed sources. The default-src directive serves as a fallback for other resource types. A strict policy of default-src 'self' blocks inline scripts, external resources, and many XSS vectors. Reporting directives send violations to a monitoring endpoint.
- default-src
- Fallback for other resource directives
- script-src
- Allowed script sources
- style-src
- Allowed stylesheet sources
- img-src
- Allowed image sources
- connect-src
- Allowed fetch and WebSocket targets
default-src 'self'script-src 'self' 'nonce-abc'style-src 'self'img-src 'self' data:connect-src 'self' api.comTransport and Framing
Strict-Transport-Security (HSTS) forces HTTPS for a domain for a specified max-age, preventing SSL stripping. X-Frame-Options or the frame-ancestors CSP directive prevent clickjacking by controlling who may embed the page in an iframe. X-Content-Type-Options nosniff prevents MIME sniffing that could execute content as a different type. These headers are cheap to deploy and provide significant defense-in-depth.
Deprecation and Migration
Several legacy headers have been superseded by CSP directives. X-Frame-Options is replaced by frame-ancestors, and X-XSS-Protection is obsolete in modern browsers that use CSP instead. Referrer-Policy controls how much referrer information is leaked and replaces the older noreferrer link type for some use cases. Migrating to CSP directives provides more granular control but requires testing to avoid breaking functionality.