Agent Wranglers

Supply chain and setup Required

Send the security headers

Send the browser security headers on every page, including a strict Content Security Policy, HSTS and nosniff.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Set them once in the web server or the app's middleware, so every route gets them. The website security chapter lists each header and its value.

Example

curl -sI https://staging.example.com/missing-page | grep -iE 'content-security|strict-transport|x-content-type'

How to check

Request the home page, an error page and an API route. Each has Content-Security-Policy, Strict-Transport-Security and X-Content-Type-Options.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/security-headers.