What is HTTP Security Headers?

HTTP security headers are response headers that switch on browser protections: HTTPS enforcement, script restrictions, anti-framing, MIME-sniffing protection and limits on powerful features.

The core set is Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy.

They are set in the web server, framework or CDN configuration and need no application code changes, which makes them one of the cheapest security improvements available.