Why Security Headers Matter
HTTP security headers instruct browsers how to safely handle your website content. Proper configuration defends against common attacks.
Testing Tools
- securityheaders.com — Header rating
- CSP Evaluator — CSP assessment
curl -sI https://example.com | grep -i "^\(x-\|strict\|content\|referrer\|permissions\)"
Key Headers
| Header | Purpose | Recommended Value |
|---|---|---|
| X-Frame-Options | Prevent clickjacking | SAMEORIGIN |
| X-Content-Type-Options | Prevent MIME sniffing | nosniff |
| HSTS | Force HTTPS | max-age=63072000; includeSubDomains |
| Referrer-Policy | Control referrer info | strict-origin-when-cross-origin |
| Permissions-Policy | Restrict browser APIs | Block unused features |
| CSP | Prevent XSS/data injection | Site-specific |
See zh-cn version for complete Nginx/Apache config examples for each header.