--- title: "Security ยท Agent Wranglers" url: https://agentwranglers.se/playbook/website/security updated: 2026-10-20 licence: "All rights reserved" --- # Security By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20. > HTTPS, a strict Content Security Policy, isolation headers, integrity checks and the other headers, policies and DNS records that keep visitors safe. **For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security`. ## Required - [Make browsers always use HTTPS](https://agentwranglers.se/playbook/website/security/hsts): Send `Strict-Transport-Security` so browsers always use HTTPS. Give it a long `max-age` (at least a year) and `includeSubDomains`, on HTTPS responses only. - [Allow only the scripts you wrote](https://agentwranglers.se/playbook/website/security/content-security-policy): Send a strict Content Security Policy, a header that says which scripts may run. Allow scripts only by nonce or hash, with `'strict-dynamic'`, `object-src 'none'`, `base-uri 'none'` and no `unsafe-inline`. - [Stop browsers guessing file types](https://agentwranglers.se/playbook/website/security/x-content-type-options): Send `X-Content-Type-Options: nosniff` on every response, so browsers don't guess file types. Give every response its correct Content-Type. - [Refuse to be framed](https://agentwranglers.se/playbook/website/security/frame-ancestors): Stop other sites from showing yours inside a frame. Use `frame-ancestors 'none'` (or a list) in the CSP, plus `X-Frame-Options` for older browsers. - [Set cookies safely or not at all](https://agentwranglers.se/playbook/website/security/cookie-attributes): Set every cookie with `Secure` and an explicit `SameSite`. Add `HttpOnly` to every cookie that no script reads. Use `SameSite=None` only for a cookie that must work inside another site. - [Limit how often anyone can call your APIs](https://agentwranglers.se/playbook/website/security/rate-limits): Put a rate limit on every endpoint that does work for each request, such as APIs, agent endpoints, forms and report collectors. ## Recommended - [Load nothing over plain HTTP](https://agentwranglers.se/playbook/website/security/mixed-content): Load every file over HTTPS. Add `upgrade-insecure-requests` as a safety net. - [Collect reports of blocked content](https://agentwranglers.se/playbook/website/security/reporting-endpoints): Name a place for browsers to send policy errors with `Reporting-Endpoints`. Log those reports without any personal data. - [Tell people how to report a hole](https://agentwranglers.se/playbook/website/security/security-txt): Publish `/.well-known/security.txt` with a contact and an `Expires` date in the future. It tells people where to report security problems. - [Refuse odd requests from other sites](https://agentwranglers.se/playbook/website/security/fetch-metadata): Browsers send `Sec-Fetch-*` headers that say where a request came from. Use them to refuse cross-site requests that are not normal page visits. - [Keep other sites' windows apart](https://agentwranglers.se/playbook/website/security/cross-origin-isolation): Send `Cross-Origin-Opener-Policy: same-origin` and a `Cross-Origin-Resource-Policy`. These keep other sites' windows and pages away from yours. Add COEP only if you need full isolation. - [Share less in the Referer header](https://agentwranglers.se/playbook/website/security/referrer-policy): Send `Referrer-Policy: strict-origin-when-cross-origin` or stricter. It limits what other sites learn about the page a visitor came from. - [Switch off browser features you don't use](https://agentwranglers.se/playbook/website/security/permissions-policy): Use `Permissions-Policy` to turn off every browser feature the site does not use. Allow the rest only for your own origin. - [Lock scripts to a known hash](https://agentwranglers.se/playbook/website/security/subresource-integrity): Put an `integrity` hash, a fingerprint of the file, on every script and stylesheet. Let the browser refuse any script without one. - [Lock down risky DOM writes](https://agentwranglers.se/playbook/website/security/trusted-types): Require Trusted Types in the CSP, so scripts can't write raw HTML into the page. Send every remaining case through one small named policy. ## Optional - [Send a hash of the body](https://agentwranglers.se/playbook/website/security/digest-fields): Send a `Content-Digest`, a hash of the response body, on files clients download to verify, such as Markdown copies and downloads. RFC 9530 defines it. - [Wipe browser data on sign-out](https://agentwranglers.se/playbook/website/security/clear-site-data): Send `Clear-Site-Data` when a person signs out. Then their data does not stay behind in the browser. ## Avoid - [Drop the old XSS header](https://agentwranglers.se/playbook/website/security/x-xss-protection): Do not turn on `X-XSS-Protection`. The filter it controls is gone from current browsers, and in old ones it could open holes. Rely on the Content Security Policy instead. - Previous: [Accessibility](https://agentwranglers.se/playbook/website/accessibility) - Next: [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network) - [All chapters](https://agentwranglers.se/playbook/website)