Browser security headers

These headers protect visitors in the browser. Send them from one place for every response, as Send the security headers as one set says. Each of the other rules explains one header and its trade-offs.

Required

• Make browsers always use HTTPS

  APS-23

  Send Strict-Transport-Security so browsers always use HTTPS. Give it a long max-age (at least a year) and includeSubDomains, on HTTPS responses only.

• Refuse to be framed

  APS-28

  Stop other sites from showing yours inside a frame. Use frame-ancestors 'none' (or a list) in the CSP, plus X-Frame-Options for older browsers.

Recommended

• Send the security headers as one set

  APS-100

  Set every browser security header in one middleware or server block that runs for every response, including errors, redirects, files and API answers. Test the whole set as one unit.

• Load nothing over plain HTTP

  APS-24

  Load every file over HTTPS. Add upgrade-insecure-requests as a safety net.

• Allow only the scripts you wrote

  APS-25

  Send a strict Content Security Policy, a header that says which scripts may run. Allow scripts only by nonce or hash, with 'strict-dynamic', object-src 'none', base-uri 'none' and no unsafe-inline.

• Collect reports of blocked content

  APS-26

  Name a place for browsers to send policy errors with Reporting-Endpoints. Log those reports without any personal data.

• Stop browsers guessing file types

  APS-27

  Send X-Content-Type-Options: nosniff on every response, so browsers don't guess file types. Give every response its correct Content-Type.

• Refuse odd requests from other sites

  APS-29

  Browsers send Sec-Fetch-* headers that say where a request came from. Use them to refuse cross-site requests that are not normal page visits.

• Keep other sites' windows apart

  APS-30

  Send Cross-Origin-Opener-Policy: same-origin and a Cross-Origin-Resource-Policy. These keep other sites' windows and pages away from yours. Add COEP only if you need full isolation.

• Share less in the Referer header

  APS-31

  Keep Referrer-Policy at the browser default, strict-origin-when-cross-origin, or stricter. Send it on every response, so no framework default, meta tag or old browser loosens it.

• Switch off browser features you don't use

  APS-32

  Use Permissions-Policy to turn off every browser feature the site does not use. Allow the rest only for your own origin.

• Lock scripts to a known hash

  APS-33

  Put an integrity hash, a fingerprint of the file, on every script and stylesheet. Let the browser refuse any script without one.

• Lock down risky DOM writes

  APS-35

  Require Trusted Types in the CSP, so scripts can't write raw HTML into the page. Send every remaining case through one small named policy.

• Share data across sites on purpose

  APS-37

  Allow other sites to read your API only from a fixed list of origins. Never copy the request's Origin into the reply when cookies are allowed.

• Check the origin of WebSocket connections

  APS-38

  Accept a WebSocket connection only from your own origins, and only after checking the user's login, as for any other request.

• Check the sender of every window message

  APS-39

  When a page listens for messages from other windows or frames, accept only those from a fixed list of origins. Never send private data to the target origin *.

• Redirect only to your own pages

  APS-40

  A redirect that takes its target from the address must only go to your own pages or an allow-list.

Optional

• Send a hash of the body

  APS-34

  Send a Content-Digest, a hash of the response body, on files clients download to verify, such as Markdown copies and downloads. RFC 9530 defines it.

Avoid

• Sending the old XSS filter header

  APS-36

  Do not turn on X-XSS-Protection. The filter it controls is gone from current browsers, and in old ones it could open holes. Rely on the Content Security Policy instead.

Read this with

• Website playbook

  HTTPS, a strict Content Security Policy and the other headers that keep visitors safe live here.

• Adversarial testing playbook

  HTTPS, script rules and security headers close many of the holes this playbook tests.

• Agents as users playbook

  Rate limits and security headers protect the same endpoints that agents call.