Complete Guide to HTTP Security Headers (CSP, HSTS & More)

HTTP Security Headers are server response directives that instruct web browsers to activate built-in defensive security protections.

Complete HTTP Security Headers Reference Matrix

Every production web application should implement the following seven foundational headers:

1. Strict-Transport-Security (HSTS): Enforces HTTPS and prevents SSL-stripping MITM attacks.
2. Content-Security-Policy (CSP): Restricts origins for scripts, styles, images, and child frames.
3. X-Frame-Options: Prevents clickjacking by restricting iframe embedding.
4. X-Content-Type-Options: Prevents MIME sniffing by forcing the browser to adhere strictly to declared Content-Type.
5. Referrer-Policy: Protects visitor privacy by restricting referrer URLs sent to third parties.
6. Permissions-Policy: Restricts browser hardware features (camera, microphone, geolocation).
7. Cross-Origin-Opener-Policy (COOP): Isolates top-level browsing contexts to defend against Spectre-style side-channel attacks.

HSTS informs browsers that an application must ONLY be accessed over HTTPS. Even if a user types http://example.com or follows an unencrypted link, the browser automatically rewrites the request to HTTPS locally before dispatching traffic.

Syntax & Directives

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

• max-age=31536000: Enforces HTTPS for one year (in seconds).
• includeSubDomains: Applies policy to all existing and future subdomains.
• preload: Authorizes submission to the official Chrome HSTS preload list (baked directly into major browsers).

Preloading Warning: Submitting to the HSTS preload list is permanent and irreversible for months. Ensure all subdomains (including legacy internal tools) support valid SSL certificates before adding preload.

A Content Security Policy defines an allowlist of trusted sources for content loaded by the browser. A modern strict CSP uses cryptographic request nonces rather than brittle domain allowlists:

Content-Security-Policy: \
  default-src 'self'; \
  script-src 'self' 'nonce-randomNonce123' 'strict-dynamic'; \
  style-src 'self' 'unsafe-inline'; \
  img-src 'self' data: https:; \
  font-src 'self' https://fonts.gstatic.com; \
  connect-src 'self' https://api.wesecurex.com; \
  frame-ancestors 'none'; \
  object-src 'none'; \
  base-uri 'none';

• frame-ancestors 'none': Supersedes X-Frame-Options: DENY in modern browsers.
• object-src 'none': Disables dangerous legacy plugins (Flash, Java Applets).
• base-uri 'none': Prevents attackers from injecting <base> tags to hijack relative URLs.

X-Frame-Options

Clickjacking tricks users into clicking transparent iframe layers positioned over benign buttons. To prevent framing:

X-Frame-Options: DENY
# Or allow framing only by your own origin:
X-Frame-Options: SAMEORIGIN

X-Content-Type-Options

Web browsers historically attempted to guess ('sniff') the MIME type of a file if the server header was missing or generic (text/plain), sometimes executing image uploads containing malicious HTML. To block this behavior:

X-Content-Type-Options: nosniff

Permissions-Policy (Formerly Feature-Policy)

Explicitly disables access to sensitive device APIs that your web application does not need:

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()

Referrer-Policy

Controls how much URL information is sent in the Referer header when visitors navigate away:

Referrer-Policy: strict-origin-when-cross-origin

Sends full path to same-origin requests, but only sends the domain (https://example.com/) on cross-origin requests, protecting query parameters containing sensitive tokens.

Below are production-grade configurations for modern web servers:

In Next.js applications, configure headers directly in next.config.js or next.config.ts:

Modern Permissions-Policy Syntax

The Permissions-Policy header allows web developers to disable invasive browser APIs that your application does not require, preventing rogue third-party advertising scripts or XSS payloads from activating hardware sensors:

# Disable camera, microphone, geolocation, and payment request APIs
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

Cross-Origin Isolation for Spectre Defense

Modern web browsers require cross-origin isolation before unlocking high-resolution performance timers (performance.now() with sub-millisecond precision) or SharedArrayBuffer to prevent CPU side-channel timing attacks (Spectre). Deploy paired headers:

add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Embedder-Policy "require-corp" always;

Audit your live HTTP security headers and detect missing directives using the WeSecureX Security Scanner.

HTTP response headers represent the first line of defense between your web application and the end-user's browser. However, configuring headers manually often results in syntax errors, obsolete directives (such as X-XSS-Protection), or overly permissive policies that leave sites exposed to clickjacking and data injection.

Comprehensive Header Intelligence via WeSecureX

When you scan a domain with the WeSecureX Free Vulnerability Scanner, our engine performs an instant cryptographic and protocol analysis:

1. HSTS & Preload Readiness: Validates Strict-Transport-Security max-age (minimum 31536000 seconds), includeSubDomains, and preload flag eligibility for Chromium and Firefox HSTS preloading.
2. CSP Level 3 Evaluation: Deconstructs your Content-Security-Policy into individual directives, flagging missing default-src, wildcard hosts (*), and dangerous permissions ('unsafe-inline', 'unsafe-eval').
3. Clickjacking & Framing Verification: Tests for the presence of X-Frame-Options: DENY and CSP frame-ancestors 'none' to prevent framing attacks.
4. Permissions-Policy Auditing: Verifies that sensitive browser capabilities (camera, microphone, geolocation) are explicitly disabled for unauthorized third-party embeds.

Instant Header Generation

In addition to flagging vulnerabilities in the Vulnerabilities Dashboard, WeSecureX generates copy-paste configuration snippets for Nginx, Cloudflare Workers, Apache, and Next.js, allowing your development team to achieve an A+ Security Grade within minutes. Test your live headers right now with our Free HTTP Security Headers Checker, verify transport with the Free SSL Checker, or consult our Website Security Guide.