Web Security Headers Guide

Content-Security-Policy (CSP)

CSP controls which resources the browser is allowed to load. It's the most effective defense against XSS attacks.

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; object-src 'none'

• default-src: Fallback for all resource types
• script-src: Where JavaScript can be loaded from
• style-src: Where CSS can be loaded from
• img-src: Where images can be loaded from
• object-src 'none': Block Flash and other plugins
• Start with report-only mode to test without breaking your site

Other Important Headers

# Prevent clickjacking
X-Frame-Options: DENY

# Stop MIME-type sniffing
X-Content-Type-Options: nosniff

# Referrer policy
Referrer-Policy: strict-origin-when-cross-origin

# Permissions policy (formerly Feature-Policy)
Permissions-Policy: camera=(), microphone=(), geolocation=()

# Strict transport security
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

CORS (Cross-Origin Resource Sharing)

CORS headers control which origins can make requests to your API.

# Allow specific origin
Access-Control-Allow-Origin: https://myapp.com

# Allow credentials (cookies)
Access-Control-Allow-Credentials: true

# Allowed methods
Access-Control-Allow-Methods: GET, POST, PUT, DELETE

# Allowed headers
Access-Control-Allow-Headers: Content-Type, Authorization

• Never use Access-Control-Allow-Origin: * with credentials
• Use a whitelist of allowed origins in production
• Preflight requests (OPTIONS) are cached via Access-Control-Max-Age

Quick Checklist

• ✅ Set a Content-Security-Policy (even a basic one)
• ✅ Enable Strict-Transport-Security (HSTS)
• ✅ Add X-Content-Type-Options: nosniff
• ✅ Set X-Frame-Options to DENY or SAMEORIGIN
• ✅ Configure Referrer-Policy
• ✅ Use Permissions-Policy to disable unused APIs
• ✅ Test your headers at securityheaders.com