1. Setting Strict-Transport-Security (HSTS)
| Directive | Effect |
|---|
max-age=63072000 | 2 years HTTPS-only |
includeSubDomains | Apply to all subdomains |
preload | Eligible for browser preload list |
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
2. Configuring Content-Security-Policy (CSP)
| Directive | Purpose |
|---|
default-src | Fallback |
script-src | JS sources |
style-src | CSS sources |
connect-src | fetch/XHR/WS |
frame-ancestors | Replaces X-Frame-Options |
report-to | Violation reporting |
Example: Strict CSP
Content-Security-Policy: default-src 'self';
script-src 'self' 'nonce-rAnd0m';
style-src 'self' 'unsafe-inline';
img-src 'self' data: https:;
connect-src 'self' https://api.example.com;
frame-ancestors 'none';
upgrade-insecure-requests;
report-to csp-endpoint
| Value | Effect |
|---|
DENY | No framing at all |
SAMEORIGIN | Same origin only |
ALLOW-FROM DEPRECATED | Use CSP frame-ancestors |
4. Setting X-Content-Type-Options
| Value | Effect |
|---|
nosniff | Disable MIME sniffing (always set) |
5. Configuring Referrer-Policy
| Value | Behavior |
|---|
no-referrer | Never send |
same-origin | Same-origin only |
strict-origin-when-cross-origin | Origin on HTTPS→HTTPS (recommended) |
no-referrer-when-downgrade | Default |
Example: Lock down browser features
Permissions-Policy: geolocation=(),
camera=(), microphone=(),
payment=(self), fullscreen=(self),
interest-cohort=()
7. Setting X-XSS-Protection
| Value | Status |
|---|
0 | Disable (modern recommendation) |
1; mode=block | Legacy filter (deprecated by browsers) |
Note: Modern browsers ignore this; use CSP instead. Set to 0 to disable buggy legacy filter.
| Directive | Purpose |
|---|
enforce | Block if no SCT |
max-age=86400 | Cache duration |
report-uri | Violation reports |
Note: Header is obsolete in modern browsers (CT is always enforced). Safe to omit on new deployments.
| Header | Use |
|---|
Access-Control-Allow-Origin | Allowed origin |
Access-Control-Allow-Methods | Allowed verbs |
Access-Control-Allow-Headers | Allowed request headers |
Access-Control-Expose-Headers | Readable response headers |
Access-Control-Allow-Credentials | Cookies allowed |
Cross-Origin-Resource-Policy | Site isolation |
Cross-Origin-Opener-Policy | Spectre mitigation |
Cross-Origin-Embedder-Policy | Required for SAB |
| Header | Use |
|---|
X-Permitted-Cross-Domain-Policies: none | Block Flash/PDF policy |
X-Download-Options: noopen | IE prevent open |
X-DNS-Prefetch-Control: off | Disable DNS prefetch |
Clear-Site-Data: "cache","cookies" | On logout |