Security headers checklist

• Content-Security-Policy essential
  default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none' Copy

  The single most effective control against XSS and data injection. Start from default-src 'none' and allowlist only what the site actually loads.

• Strict-Transport-Security essential
  max-age=31536000; includeSubDomains; preload Copy

  Forces HTTPS for future visits, defeating SSL-strip downgrade attacks. Add preload only once you are committed to HTTPS on every subdomain.

• X-Content-Type-Options essential
  nosniff Copy

  Stops the browser from MIME-sniffing a response into a different, executable content type.

• X-Frame-Options recommended
  DENY Copy

  Clickjacking defense for older browsers. Modern browsers honor CSP frame-ancestors, but this remains a cheap fallback.

• Referrer-Policy recommended
  strict-origin-when-cross-origin Copy

  Limits how much of the URL is leaked in the Referer header on cross-origin navigation.

• Permissions-Policy recommended
  camera=(), microphone=(), geolocation=(), payment=() Copy

  Explicitly disables powerful browser features the site does not use, shrinking the attack surface.

• Cross-Origin-Opener-Policy situational
  same-origin Copy

  Isolates the browsing context from cross-origin windows, a prerequisite for cross-origin isolation and a defense against some side-channel attacks.

• Cross-Origin-Resource-Policy situational
  same-origin Copy

  Prevents other origins from embedding your resources, mitigating cross-origin leaks like Spectre-style reads.

← ~/tools