Security headers checklist

• Content-Security-Policyessential
  default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'Copy

  The single most effective control against XSS and data injection. Start from default-src 'none' and allowlist only what the site actually loads.

• Strict-Transport-Securityessential
  max-age=31536000; includeSubDomains; preloadCopy

  Forces HTTPS for future visits, defeating SSL-strip downgrade attacks. Add preload only once you are committed to HTTPS on every subdomain.

• X-Content-Type-Optionsessential
  nosniffCopy

  Stops the browser from MIME-sniffing a response into a different, executable content type.

• X-Frame-Optionsrecommended
  DENYCopy

  Clickjacking defense for older browsers. Modern browsers honor CSP frame-ancestors, but this remains a cheap fallback.

• Referrer-Policyrecommended
  strict-origin-when-cross-originCopy

  Limits how much of the URL is leaked in the Referer header on cross-origin navigation.

• Permissions-Policyrecommended
  camera=(), microphone=(), geolocation=(), payment=()Copy

  Explicitly disables powerful browser features the site does not use, shrinking the attack surface.

• Cross-Origin-Opener-Policysituational
  same-originCopy

  Isolates the browsing context from cross-origin windows, a prerequisite for cross-origin isolation and a defense against some side-channel attacks.

• Cross-Origin-Resource-Policysituational
  same-originCopy

  Prevents other origins from embedding your resources, mitigating cross-origin leaks like Spectre-style reads.

← ~/tools