Guides · Security

HTTP security headers: practical foundations

HTTP security headers add rules enforced by the browser. They do not repair a vulnerable application, but they can reduce several classes of risk and clarify expected browser behaviour.

Practical guideSecurity

HSTS and HTTPS

Strict-Transport-Security asks the browser to use HTTPS on future visits. It should only be enabled when the domain and its resources work correctly over HTTPS.

  • Enforce HTTPS before adding HSTS.
  • Increase max-age progressively in production.
  • Use includeSubDomains only when every subdomain is compatible.

CSP and allowed sources

Content-Security-Policy restricts the sources of scripts, styles, images and other resources. A strict CSP often requires an inventory before production rollout.

  • Start by listing the sources the site genuinely uses.
  • Avoid unsafe-inline when the architecture allows it.
  • Test the policy before blocking critical resources.

Complementary headers

X-Content-Type-Options: nosniff, Referrer-Policy and Permissions-Policy reduce some implicit browser behaviours.

  • Enable nosniff to restrict MIME interpretation.
  • Choose a referrer policy that matches measurement needs.
  • Disable unused browser features through Permissions-Policy.

Practical checklist

  • HTTPS works everywhere.
  • HSTS enabled carefully.
  • CSP tested against real resources.
  • nosniff present.
  • Referrer-Policy and Permissions-Policy defined.

Secure contact forms

Learn the best practices for securing a contact form: validation, honeypot, anti-spam, field cleaning, CRLF protection, and consent.

Read the guide

Securing a website through updates and dependencies

Organise updates for CMS components, libraries and dependencies to reduce exposure to known vulnerabilities.

Read the guide

Audit Express Web

Check several HTTP headers and visible security signals.

Open the tool

Web security: reduce common risks

Forms, HTTP headers and dependencies: practical measures to strengthen a website’s security.

View the topic

Conclusion

Security headers offer a strong effort-to-benefit ratio once a site is correctly configured. They still need testing because an overly strict policy can block legitimate resources.