HTTP Security Headers Checklist

Also Known As

TL;DR

Explanation

Key security headers: Content-Security-Policy (controls which resources can load — mitigates XSS), Strict-Transport-Security (forces HTTPS for a duration), X-Frame-Options / frame-ancestors (prevents clickjacking), X-Content-Type-Options: nosniff (prevents MIME sniffing), Referrer-Policy (controls what referrer is sent), Permissions-Policy (disables browser features like camera/microphone). Tools: securityheaders.com grades your headers. Add headers in nginx config, not PHP, for performance.

Common Misconception

Why It Matters

Common Mistakes

• CSP with 'unsafe-inline' — negates most of the XSS protection; use nonces or hashes instead.
• HSTS without includeSubDomains — subdomains can still be attacked over HTTP.
• Setting security headers in PHP instead of nginx/Apache — adds overhead on every request; set at the server level.
• Not testing headers with securityheaders.com or Mozilla Observatory after deployment.

Code Examples

# nginx — no security headers:
server {
    listen 443 ssl;
    location / {
        proxy_pass http://app:9000;
        # No security headers — fails any security audit
    }
}

# nginx — full security header set:
add_header Strict-Transport-Security   'max-age=31536000; includeSubDomains; preload' always;
add_header X-Frame-Options             'DENY' always;
add_header X-Content-Type-Options      'nosniff' always;
add_header Referrer-Policy             'strict-origin-when-cross-origin' always;
add_header Permissions-Policy          'geolocation=(), microphone=(), camera=()' always;
add_header Content-Security-Policy     "default-src 'self'; script-src 'self' 'nonce-$csp_nonce'; style-src 'self' 'unsafe-inline'" always;
# Test at: https://securityheaders.com

References

• ↗ https://securityheaders.com/
• ↗ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#security

Tags

Related Terms