Reference
HTTP security headers
A quick reference for headers you'll often see mentioned in security scans and site audits.
Content-Security-Policy (CSP)
Restricts which sources of scripts, styles, images, and other resources a browser is allowed to load, reducing the impact of cross-site scripting (XSS).
Strict-Transport-Security (HSTS)
Tells browsers to only ever connect to a site over HTTPS, even if a user types "http://" or clicks an old http link.
X-Content-Type-Options
Set to "nosniff" to stop browsers from guessing ("sniffing") a file's type in a way that could be exploited to run unintended scripts.
Referrer-Policy
Controls how much information about the referring page is sent when a user navigates away, limiting accidental data leakage.
Permissions-Policy
Lets a site explicitly allow or deny access to browser features like camera, microphone, or geolocation, including for embedded content.
X-Frame-Options
Controls whether a page can be embedded in a frame on another site, helping prevent clickjacking attacks.
This site itself applies a baseline set of these headers — see our Privacy Policy for details on what we collect.