HTTP Security Headers

Also Known As

TL;DR

Explanation

Key security headers and their purpose: Content-Security-Policy (restricts resource loading, mitigates XSS), X-Frame-Options (prevents clickjacking — superseded by CSP frame-ancestors), X-Content-Type-Options: nosniff (prevents MIME-type sniffing), Referrer-Policy (controls referrer leakage), Permissions-Policy (restricts browser feature access), Strict-Transport-Security (enforces HTTPS), and Cross-Origin-Opener-Policy/Cross-Origin-Embedder-Policy (isolation for SharedArrayBuffer). Use securityheaders.com to audit. In PHP, emit all headers before output.

Common Misconception

Why It Matters

Common Mistakes

• Not setting Content-Security-Policy — leaves XSS execution unrestricted even after injection.
• Omitting X-Content-Type-Options: nosniff — browsers may interpret uploaded files as executable.
• Setting X-Frame-Options instead of CSP frame-ancestors — the latter supersedes it in modern browsers.
• Using a permissive CSP like unsafe-inline or unsafe-eval which negates most of its protection.

Code Examples

// No security headers set — default browser behaviour

header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('Referrer-Policy: strict-origin-when-cross-origin');
header('Permissions-Policy: geolocation=(), microphone=()');

References

• ↗ https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
• ↗ https://securityheaders.com/

Tags

Related Terms