Security

Required

• Make browsers always use HTTPS

  Required

  Send Strict-Transport-Security so browsers always use HTTPS. Give it a long max-age (at least a year) and includeSubDomains, on HTTPS responses only.

• Allow only the scripts you wrote

  Required

  Send a strict Content Security Policy, a header that says which scripts may run. Allow scripts only by nonce or hash, with 'strict-dynamic', object-src 'none', base-uri 'none' and no unsafe-inline.

• Stop browsers guessing file types

  Required

  Send X-Content-Type-Options: nosniff on every response, so browsers don't guess file types. Give every response its correct Content-Type.

• Refuse to be framed

  Required

  Stop other sites from showing yours inside a frame. Use frame-ancestors 'none' (or a list) in the CSP, plus X-Frame-Options for older browsers.

• Set cookies safely or not at all

  Required

  Set every cookie with Secure and an explicit SameSite. Add HttpOnly to every cookie that no script reads. Use SameSite=None only for a cookie that must work inside another site.

• Limit how often anyone can call your APIs

  Required

  Put a rate limit on every endpoint that does work for each request, such as APIs, agent endpoints, forms and report collectors.

Recommended

• Load nothing over plain HTTP

  Recommended

  Load every file over HTTPS. Add upgrade-insecure-requests as a safety net.

• Collect reports of blocked content

  Recommended

  Name a place for browsers to send policy errors with Reporting-Endpoints. Log those reports without any personal data.

• Tell people how to report a hole

  Recommended

  Publish /.well-known/security.txt with a contact and an Expires date in the future. It tells people where to report security problems.

• Refuse odd requests from other sites

  Recommended

  Browsers send Sec-Fetch-* headers that say where a request came from. Use them to refuse cross-site requests that are not normal page visits.

• Keep other sites' windows apart

  Recommended

  Send Cross-Origin-Opener-Policy: same-origin and a Cross-Origin-Resource-Policy. These keep other sites' windows and pages away from yours. Add COEP only if you need full isolation.

• Share less in the Referer header

  Recommended

  Send Referrer-Policy: strict-origin-when-cross-origin or stricter. It limits what other sites learn about the page a visitor came from.

• Switch off browser features you don't use

  Recommended

  Use Permissions-Policy to turn off every browser feature the site does not use. Allow the rest only for your own origin.

• Lock scripts to a known hash

  Recommended

  Put an integrity hash, a fingerprint of the file, on every script and stylesheet. Let the browser refuse any script without one.

• Lock down risky DOM writes

  Recommended

  Require Trusted Types in the CSP, so scripts can't write raw HTML into the page. Send every remaining case through one small named policy.

Optional

• Send a hash of the body

  Optional

  Send a Content-Digest, a hash of the response body, on files clients download to verify, such as Markdown copies and downloads. RFC 9530 defines it.

• Wipe browser data on sign-out

  Optional

  Send Clear-Site-Data when a person signs out. Then their data does not stay behind in the browser.

Avoid

• Drop the old XSS header

  Avoid

  Do not turn on X-XSS-Protection. The filter it controls is gone from current browsers, and in old ones it could open holes. Rely on the Content Security Policy instead.