A complete reference for HTTP security headers. Each header is listed with what it does, recommended configuration, and common mistakes. Use the Headers tool to check any site.
Forces browsers to connect over HTTPS for all future requests to the domain. Once set, the browser will refuse plain HTTP connections until the max-age expires.
Recommended: max-age=31536000; includeSubDomains; preload
Start without preload until you are sure all subdomains support HTTPS.
Controls which sources the browser is allowed to load resources from. This is the strongest defense against cross-site scripting (XSS) because it blocks inline scripts and unauthorized origins at the browser level.
Recommended: default-src 'self' and add sources as needed.
Avoid unsafe-inline and unsafe-eval. They defeat the purpose of CSP.
Prevents your page from being embedded in an iframe on another site, which blocks clickjacking attacks.
Recommended: DENY or SAMEORIGIN
Being superseded by CSP frame-ancestors, but still worth setting for older browser support.
Tells the browser not to guess the MIME type of a response. Without this, browsers may interpret a file as a different content type, which can lead to XSS via MIME confusion.
Recommended: nosniff
No reason not to set this on every response.
Controls how much referrer information the browser includes when navigating away from your site. Limits URL leakage to third parties.
Recommended: strict-origin-when-cross-origin or no-referrer
strict-origin-when-cross-origin is the best default. It sends the origin on cross-origin requests but the full URL on same-origin requests.
Restricts which browser APIs your page can use, such as camera, microphone, and geolocation. Also controls what features embedded iframes are allowed to access.
Recommended: camera=(), microphone=(), geolocation=()
Disable every feature you do not use. This limits damage if your site is ever compromised.
Isolates your browsing context so that cross-origin documents cannot retain a reference to your window. Prevents certain cross-origin attacks that rely on window handle access.
Recommended: same-origin
Use same-origin for sites that do not need cross-origin popups or OAuth flows that rely on window.opener.
Controls which origins are allowed to load your resources (images, scripts, fonts). Blocks unauthorized cross-origin reads at the network level.
Recommended: same-origin
Use same-origin unless you intentionally serve public assets like a CDN. Use cross-origin for public resources.
Requires all cross-origin resources loaded by your page to explicitly opt in via CORS or CORP headers. Needed to enable cross-origin isolation, which unlocks SharedArrayBuffer and high-resolution timers.
Recommended: require-corp
Only set this if you need cross-origin isolation. It will break third-party resources that lack CORS or CORP headers.
A legacy header that controlled the browser's built-in XSS filter. Modern browsers have removed this filter entirely because it introduced its own vulnerabilities.
Recommended: 0
Set to 0 to explicitly disable. Do not use mode=block. Use Content-Security-Policy instead.
Check which security headers any site is sending.
Scan your headersLearn more about individual headers: HSTS, Content Security Policy.