Security 8 min read
The HTTP security headers worth checking — and what bad values look like
Security headers are cheap to add and easy to get subtly wrong. They do not replace input validation or authentication, but they reduce the damage of whole classes of bugs: script injection, clickjacking, protocol downgrade and accidental data leakage through the Referer header.
This checklist is ordered by practical impact. Fetch the headers, read them one at a time, and change one thing per deploy so you can tell what broke.
Content-Security-Policy
CSP limits where scripts, styles, images and connections may come from. A policy full of 'unsafe-inline' and wildcard hosts provides little protection. Start in report-only mode, collect violations, then enforce a policy that names the hosts you actually use.
Inline event handlers and inline scripts are the usual blockers. Moving them into files with nonces or hashes makes a strict policy possible. Beware of adding a broad third-party script without updating the policy deliberately.
A reasonable starting direction
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Strict-Transport-Security
HSTS tells browsers to use HTTPS for this host for a period of time. Set a modest max-age first, confirm every subdomain works over HTTPS, then consider includeSubDomains. Preload is effectively permanent for the domain, so treat it as a long-term commitment.
X-Content-Type-Options and Referrer-Policy
X-Content-Type-Options: nosniff stops browsers from guessing a file's type and executing it as something else. It is a one-line win on every response.
Referrer-Policy controls how much URL information leaks to other sites. strict-origin-when-cross-origin is a sensible default; no-referrer is stricter but can break analytics and partner attribution that relies on referrers.
Framing and Permissions-Policy
X-Frame-Options: DENY prevents framing, while CSP frame-ancestors is the modern equivalent and allows a specific allow-list. Use both for older browsers if you need broad compatibility.
Permissions-Policy disables browser features the page does not need, such as camera, microphone and geolocation. It is defence in depth rather than a primary control.
What about Server and X-Powered-By?
Version banners help attackers choose exploits. Removing them is easy and low-risk, but do not mistake banner hygiene for real security. A server with no banner and an unpatched vulnerability is still unpatched.
Frequently asked questions
Do security headers improve SEO?
Why does my CDN show different headers than my origin?
Put it into practice
HTTP Header Checker
Response headers plus a practical security-header audit.
SSL Certificate Checker
Check TLS issuer, expiry and covered domains.
DNS Lookup
Query DNS records over DoH with multiple record types.
URL Decoder
Turn percent-encoded links back into readable text.