Glossary
Security headers
Security headers are HTTP response headers that instruct the browser to enforce protections such as transport security, framing rules and allowed script sources.
Updated 2 Sept 2026
In detail
Because they are enforced by the browser, security headers act as a second line of defence: they limit what an injected script, a clickjacking frame or a downgraded connection can achieve even when an application flaw exists. The practical set is small — Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, and a framing rule via CSP's frame-ancestors — and each addresses a specific browser behaviour rather than a generic 'hardening' goal.
Why it matters
Headers are the cheapest control available on most sites: they are configuration, not code, and they measurably reduce the impact of cross-site scripting, mixed content and UI redress attacks. They are also verifiable from outside the application, which makes them a reliable audit signal.
Examples
- Strict-Transport-Security: max-age=31536000; includeSubDomains — forces HTTPS for a year.
- Content-Security-Policy: default-src 'self'; frame-ancestors 'none' — blocks unlisted script origins and framing.
- X-Content-Type-Options: nosniff — stops the browser guessing a response's MIME type.