Bridge WAF
HTTP security headers: what to send, and how to check
Security headers are HTTP response headers that tell the browser how to treat your site: use HTTPS only, run only the scripts you allow, refuse to be framed by other sites, and keep referrer and device access in check. They cost nothing to send, take minutes to check, and close whole classes of attack in the browser rather than on the server.
Quick facts
- Where they live
- In HTTP responses from your server, edge network or application
- Who enforces them
- The visitor's browser
- Core set
- Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, frame protection, Referrer-Policy
- How to check
- Browser developer tools, or a command-line request that prints headers
- Reference
- OWASP HTTP Headers Cheat Sheet
Headers protect visitors' browsers. They do not filter requests to your server; that is a different layer.
The security headers to set
| Header | What it does | Common value |
|---|---|---|
| Strict-Transport-Security | Browser uses HTTPS only for your site, for a period | max-age of a year, includeSubDomains when ready |
| Content-Security-Policy | Limits which scripts, styles and other resources run | Built per site; start in report-only mode |
| X-Content-Type-Options | Stops the browser guessing a file's type | nosniff |
| frame-ancestors | Controls who may put your pages in a frame (X-Frame-Options in older browsers) | 'self' or none |
| Referrer-Policy | Limits what address is sent to other sites | strict-origin-when-cross-origin |
| Permissions-Policy | Turns off browser features you do not use | camera, microphone, geolocation off |
References: RFC 6797 for Strict-Transport-Security, and MDN on Content-Security-Policy, X-Content-Type-Options, frame-ancestors, Referrer-Policy and Permissions-Policy.
Start with the ones that cannot break anything, nosniff and Referrer-Policy, then HSTS once every subdomain serves HTTPS, then a Content Security Policy in report-only mode.
How to check security headers yourself
- In a browser. Open developer tools, go to the Network tab, reload, select the page request and read Response Headers.
- From the command line. Request only the headers and read them, as below.
- On more than the home page. Check a logged-in page, an error page and a file download; servers often send different headers on each.
curl -sI https://example.com/ | grep -i -E 'strict-transport|content-security|x-content-type|x-frame|referrer-policy|permissions-policy'Referrer-Policy: strict-origin-when-cross-origin
This value sends the full address on requests within your site, only the origin (scheme and host) to other sites over HTTPS, and nothing when moving from HTTPS to HTTP. It keeps paths and query strings, which may contain identifiers, from leaking to third parties.
It is the default in current browsers when no policy is set, according to MDN; setting it explicitly makes the behaviour the same in older ones.
Frame protection and clickjacking
A page that can be framed by any site can be overlaid with a decoy (clickjacking), so a user clicks a button they cannot see. The CSP directive frame-ancestors decides which origins may frame your pages; X-Frame-Options does the same for older browsers.
Set frame-ancestors to 'self' unless you know which partners embed your pages, and list them by name if they do.
CORS: cross-origin resource sharing
CORS headers relax the browser's same-origin rule: they tell it which other origins may read your responses. They grant access rather than restrict it, so the security question is what you allow. The mistakes that leak data are on CORS misconfiguration.
- Do not reflect any Origin back while also allowing credentials; that lets every site read signed-in responses.
- List allowed origins explicitly, and avoid patterns that match look-alike domains.
- Return CORS headers only where needed, such as API endpoints called from other origins.
Questions
What are HTTP security headers?
HTTP security headers are response headers that tell browsers how to treat a site, such as using HTTPS only, running only allowed scripts, refusing framing by other sites and limiting referrer information.
How do I check my website's security headers?
Open the browser's developer tools, reload the page and read the response headers in the Network tab, or request the page from the command line and print only the headers.
What does Referrer-Policy strict-origin-when-cross-origin mean?
It sends the full address within your site, only the origin to other sites over HTTPS, and nothing when going from HTTPS to HTTP.
Which security headers are most important?
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, frame protection with frame-ancestors or X-Frame-Options, and Referrer-Policy.