Security Headers

Security headers are HTTP response headers a server sends to tell the browser which protective behaviours to apply to a page. They add defence in depth against attacks like cross-site scripting, clickjacking and downgrade to HTTP.

Why it matters

Browsers have many features that are safe to switch on but are not enabled by default for compatibility reasons. Headers are a cheap way to opt in, usually through server or CDN configuration without code changes. Commonly used ones include Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.

Example

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=()

Each line enables one browser-side protection for the page.

Common mistakes

• Copying a strict Content Security Policy without testing, which breaks scripts and styles.
• Setting headers on the main page but not on error pages or other hosts.
• Assuming headers fix vulnerable code. They reduce impact, not root causes.
• Letting a CDN or proxy overwrite or drop them.

Related

• HSTS
• Content Security Policy
• X-Frame-Options
• Referrer-Policy
• टूल: Security headers checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.