The Complete Guide to HTTP Security Headers
Protect your web applications from XSS, clickjacking, and code injection by configuring proper HTTP security headers.
A significant portion of web vulnerabilities can be mitigated without touching a single line of application code. By properly configuring HTTP Security Headers on your web server (Nginx, Apache, Node.js, Vercel), you can force the browser to enable strict security protocols.
Here are the most critical security headers you should implement today.
1. Content-Security-Policy (CSP)
CSP is the heavyweight champion of security headers. It prevents Cross-Site Scripting (XSS) and data injection attacks by restricting where scripts, styles, and images can be loaded from.
Example: Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.cdn.com;
This tells the browser to ONLY execute scripts originating from your own domain or a specific trusted CDN, completely neutralizing injected malicious scripts.
2. Strict-Transport-Security (HSTS)
HSTS forces the browser to always connect to your site over HTTPS, even if the user types http:// into the address bar. It protects against man-in-the-middle downgrade attacks.
Example: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
3. X-Frame-Options
This header prevents your site from being embedded inside an <iframe> on another domain, neutralizing Clickjacking attacks where an attacker tricks a user into clicking a transparent overlay.
Example: X-Frame-Options: SAMEORIGIN
4. X-Content-Type-Options
Forces the browser to respect the Content-Type header sent by the server, preventing MIME-sniffing attacks where a malicious user uploads a JavaScript file disguised as an image.
Example: X-Content-Type-Options: nosniff
5. Referrer-Policy
Controls how much referrer information (the URL the user clicked from) is sent to the destination server. This prevents sensitive tokens in your URLs from leaking to third-party analytics scripts.
Example: Referrer-Policy: strict-origin-when-cross-origin