Production-ready web hardening knowledge base

Secure Your Stack with Verified HTTPS and Header Controls

Implementation-first guidance for developers, sysadmins, and security engineers. Get exact directives, stack-specific syntax, and diagnostics you can run in production — with copy-pasteable config and safe rollback steps. No marketing, no hedging.

Explore Fundamentals Open Implementation Guides

The landscape

Seven groups of headers, seven failure modes

The headers covered here are not a flat list of switches to flip. They fall into distinct functional groups, each defending a different failure mode — knowing which group a header belongs to tells you what it can and cannot protect.

Transport security

HSTS (Strict-Transport-Security) refuses plaintext HTTP to your origin for a fixed duration, converting every future request to HTTPS before it leaves the machine — closing protocol-downgrade and SSL-stripping attacks and the vulnerable first redirect.

Resource-loading control

Content-Security-Policy allowlists scripts, styles, and connections to named sources — the strongest structural defence against XSS. Subresource Integrity pins a hash to each external asset so a tampered CDN file fails to load.

Framing control

The legacy X-Frame-Options switch and CSP's frame-ancestors allowlist decide who may embed your pages, defending against clickjacking and UI-redressing attacks.

Cross-origin isolation

COOP, COEP, and CORP sever attacker-controlled cross-origin references and place a page in an isolated state that mitigates Spectre-class side channels and unlocks SharedArrayBuffer.

Privacy & feature control

Referrer-Policy and Permissions-Policy trim what the Referer header leaks and declare which powerful features (camera, microphone, geolocation) the page and its frames may use.

State & caching

Cache-Control and Clear-Site-Data keep authenticated responses out of shared caches and wipe cookies, storage, and cached entries on demand — most usefully at logout.

Legacy & deprecated

X-XSS-Protection, Expect-CT, and version-disclosing banners like Server once served a purpose but are now retired. The deprecated headers reference explains what to drop and what to keep for old clients.

Copy-paste starting point

A recommended baseline

A sensible default for a typical authenticated web app — a baseline to tighten, not a finished policy. Roll CSP out in Content-Security-Policy-Report-Only first and start HSTS with a short max-age; both headers are far easier to widen than to retract.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
X-Frame-Options: SAMEORIGIN

Web Security Headers Fundamentals

Threat models, browser enforcement, and directive syntax for every core header, with trade-offs such as HSTS preload irreversibility and CSP breakage risk.

Go to Fundamentals

Server & Platform Implementation Guides

Concrete syntax for Nginx, Apache, Cloudflare, Node/Express, FastAPI/Django, and Vercel/Next.js, with the precedence rules that cause duplicate-header bugs.

Go to Implementation Guides

Security Header Auditing & Compliance

Verify, scan, grade, and monitor headers across an estate — from a one-pass audit checklist to CI/CD gates and CSP violation telemetry.

Go to Auditing & Compliance

Jump to a common task

Generate per-request CSP noncesCryptographic nonces for inline scripts, regenerated every response.
Configure HSTS max-age & includeSubDomainsStaged rollout from a short max-age to full preload.
Fix X-Frame-Options blocking an iframeAllowlist a trusted embedder with frame-ancestors.
Set CSP in Django middlewaredjango-csp settings and a hand-rolled middleware class.
Add a nonce-based CSP in Next.jsPer-request nonces from edge middleware.
Clear client state on logoutPurge cookies, storage, and cache with Clear-Site-Data.
Audit headers from the command linecurl, openssl, and testssl.sh with expected output.
Remove version-disclosing headersStrip X-Powered-By and Server across the stack.
Generate SRI hashes for CDN scriptsopenssl and shasum one-liners plus build-tool automation.
Allowlist GTM & Analytics in CSPThe exact script-src and connect-src for GA4 and gtag.js.
Map headers to PCI DSS & SOC 2Which header satisfies which audit control, with evidence.

Quick verification checks

curl -sI https://your-domain.com | grep -iE 'strict-transport-security|content-security-policy|x-frame-options|x-content-type-options|referrer-policy|permissions-policy'
openssl s_client -connect your-domain.com:443 -servername your-domain.com