HTTP Security Headers

Essential Security Headers

Header	Protects Against	Priority
Content-Security-Policy	XSS, data injection	High
Strict-Transport-Security	HTTP downgrade, MITM	High
X-Frame-Options	Clickjacking	High
X-Content-Type-Options	MIME sniffing	High
Referrer-Policy	Referrer leakage	Medium
Permissions-Policy	Browser feature abuse	Medium
Cross-Origin-Opener-Policy	Spectre, XS-Leaks	Medium

Nginx Configuration Example

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(self)" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;

# Content Security Policy (customize for your site)
add_header Content-Security-Policy "
  default-src 'self';
  script-src 'self' 'nonce-RANDOM' https://cdn.trusted.com;
  style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
  font-src 'self' https://fonts.gstatic.com;
  img-src 'self' data: https:;
  connect-src 'self' https://api.example.com;
  frame-ancestors 'none';
  base-uri 'self';
  form-action 'self';
" always;

CSP Directive Reference

Directive	Controls	Common Value
default-src	Fallback for all	'self'
script-src	JavaScript	'self' 'nonce-xxx'
style-src	CSS	'self' 'unsafe-inline'
img-src	Images	'self' data: https:
connect-src	fetch/XHR/WebSocket	'self' https://api.com
frame-ancestors	Who can embed	'none' or 'self'

HTTP Security Headers

Essential Security Headers

Nginx Configuration Example

CSP Directive Reference

أدوات ذات صلة