Security Headers Reference

Showing 12 of 12 headers.

• Strict-Transport-SecurityA+Transport

  Tells browsers to only connect via HTTPS for the specified duration. Prevents SSL stripping attacks.

• X-Content-Type-OptionsA+Content

  Prevents browsers from MIME-sniffing a response away from the declared Content-Type.

• X-Frame-OptionsAFraming

  Prevents this page from being embedded in iframes. Use DENY or SAMEORIGIN to prevent clickjacking.

• Referrer-PolicyAPrivacy

  Controls how much referrer information is included with requests. Prevents leaking full URLs to third parties.

• Permissions-PolicyAFeatures

  Controls which browser features (camera, microphone, GPS, etc.) the page is allowed to use.

• Content-Security-PolicyA+Content

  The most powerful defense against XSS. Restricts what resources (scripts, styles, images) the page can load and from where.

• Cross-Origin-Opener-PolicyBIsolation

  Isolates your page from other origins. Prevents cross-origin pages from interacting with your window object.

• Cross-Origin-Embedder-PolicyBIsolation

  Required for cross-origin isolation. Enables SharedArrayBuffer and other powerful APIs.

• Cross-Origin-Resource-PolicyBIsolation

  Prevents other origins from loading your resources (images, fonts, scripts) without explicit CORS.

• X-DNS-Prefetch-ControlBPerformance

  Controls browser DNS prefetching. Disable for privacy-sensitive applications.

• X-Permitted-Cross-Domain-PoliciesBContent

  Prevents Adobe Flash and PDF readers from loading cross-domain content. Deprecated but still recommended for older browsers.

• X-Download-OptionsBContent

  Prevents Internet Explorer from executing downloaded HTML files in the context of the site. Legacy header for IE only.