HTTP Headers Analyzer

At minimum: Strict-Transport-Security (HSTS), X-Content-Type-Options: nosniff, X-Frame-Options: DENY or SAMEORIGIN, and Referrer-Policy. Content-Security-Policy is the most powerful security header but requires careful tuning. Cache-Control is critical for performance. Together these prevent the most common web vulnerabilities.

CSP is a browser-enforced allowlist that specifies which sources of scripts, styles, images, and other resources are permitted. A strong CSP like 'default-src "self"' blocks all inline scripts and external resource loading by default, eliminating most XSS attack vectors. Start with report-only mode to audit before enforcing.

HTTP Strict Transport Security (HSTS) tells browsers to only connect via HTTPS for a specified period. Once cached, the browser will refuse HTTP connections entirely — even if the user types http://. This prevents SSL stripping attacks. Use max-age=31536000 (1 year) for production sites. Submit to the HSTS preload list for maximum protection.

X-Frame-Options prevents your site from being embedded in iframes on other domains. This blocks clickjacking attacks where attackers overlay your site to trick users into clicking hidden elements. Use DENY (block all framing) or SAMEORIGIN (only allow your own domain). Note: CSP frame-ancestors is the modern replacement and offers more granular control.

Cache-Control tells browsers and CDNs how long to cache a response. Key directives: max-age=N (cache for N seconds), no-cache (must revalidate before using cached copy), no-store (never cache — for sensitive data), immutable (resource will never change — use with content-hashed filenames), public (allow CDN caching), private (only browser cache). For static assets with hashed filenames, use max-age=31536000, immutable.

Permissions-Policy (formerly Feature-Policy) controls which browser APIs and features a page can access. For example, camera=(), microphone=() disables access to those hardware features, reducing the attack surface even if XSS occurs. List only the features your page needs and deny everything else.