Guides
How to Audit HTTP Security Headers
Headers reduce browser-side risk when they match the site's behavior, but they do not prove that the application is secure.
Start with HTTPS, then check CSP, frame protection, nosniff and referrer policy. Treat missing or weak headers as review items, not proof of compromise.
Secure the transport layer with HTTPS and HSTS
Deliver all public traffic over HTTPS with valid certificates. Deploy Strict-Transport-Security (HSTS) with a positive max-age (such as max-age=31536000) only after confirming permanent HTTPS coverage across all subdomains. Crucially, max-age=0 zeroes the HSTS policy (RFC 6797) and leaves future visits unprotected.
Construct a restrictive Content-Security-Policy
Deploy CSP via HTTP response headers to limit resource execution. Restrict default-src, script-src, object-src 'none', and frame-ancestors. Avoid broad allowances like 'unsafe-inline' and 'unsafe-eval' or wildcards (*), replacing them with nonces or SHA-256 hashes to mitigate cross-site scripting (XSS).
Protect against clickjacking and MIME sniffing
Configure frame-ancestors in CSP (and X-Frame-Options: DENY for older user agents) to prevent malicious third parties from embedding the site within hidden iframes. Set X-Content-Type-Options: nosniff to force browsers to honor declared MIME types rather than guessing executable content.
Implement cross-origin isolation and privacy headers
Achieving cross-origin isolation requires both Cross-Origin-Opener-Policy (COOP: same-origin) and Cross-Origin-Embedder-Policy (COEP: require-corp or credentialless). Set Referrer-Policy: strict-origin-when-cross-origin to prevent leaking query parameters on external navigation, and use Permissions-Policy to disable unused camera, microphone, and geolocation APIs.
State audit boundaries transparently
A response-header scan is an essential defense-in-depth check, but it is not a penetration test. It cannot detect backend SQL injection, broken authentication, vulnerable third-party dependencies, or business-logic flaws. Comprehensive security requires dedicated dynamic and static testing.