---
title: "Send the security headers · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/security-headers
updated: 2026-10-20
licence: "All rights reserved"
---

# Send the security headers

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)
- Rule: Send the browser security headers on every page, including a strict Content Security Policy, HSTS and `nosniff`.
- How: Set them once in the web server or the app's middleware, so every route gets them. The [website security chapter](https://agentwranglers.se/playbook/website/security) lists each header and its value.
- Check: Request the home page, an error page and an API route. Each has `Content-Security-Policy`, `Strict-Transport-Security` and `X-Content-Type-Options`.

Example:

```sh
curl -sI https://staging.example.com/missing-page | grep -iE 'content-security|strict-transport|x-content-type'
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/security-headers`.

- Previous: [Log attacks without personal data](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/security-logging)
- Next: [Plan attacks before building](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/threat-model)
- [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)