Glossary

Security Headers

Security headers are HTTP response headers that instruct the browser to apply additional security measures. Free protection with a single line of server configuration.

Important headers

Strict-Transport-Security: max-age=31536000; includeSubDomains — always HTTPS, even if the user typed http://
Content-Security-Policy — which sources to trust for scripts, styles, images. Protects against XSS
X-Frame-Options: DENY — block embedding in iframes. Protects against clickjacking
X-Content-Type-Options: nosniff — browser does not sniff content type
Referrer-Policy: strict-origin-when-cross-origin — controls the Referer header
Permissions-Policy — restrict access to browser APIs (camera, mic, geolocation)

Checking

securityheaders.com — free scanner with A-F grading. Mozilla Observatory — additional audit.