Response Headers Checker
Security-focused guide to HTTP response headers with implementation recommendations.
🔒 Security Headers Checklist
Forces HTTPS connections for the domain
max-age=31536000; includeSubDomains; preloadPrevents XSS and injection attacks
default-src 'self'; script-src 'self' 'unsafe-inline'Prevents clickjacking by controlling framing
SAMEORIGINPrevents MIME type sniffing attacks
nosniffControls referrer information sent
strict-origin-when-cross-originControls browser feature access
geolocation=(), camera=(), microphone=()Legacy XSS filter (CSP is preferred)
1; mode=blockSecurity Response Headers Guide
Response headers are your first line of defense against web attacks. Properly configured security headers can prevent cross-site scripting (XSS), clickjacking, code injection, and other common vulnerabilities. This guide focuses on the most important security headers for modern websites.
Many hosting providers and CDNs make implementing these headers straightforward through configuration files or admin panels. Prioritize critical headers first, then implement additional protection as appropriate for your application.
HSTS: Enforcing HTTPS
Strict-Transport-Security tells browsers to only connect via HTTPS, preventing downgrade attacks and cookie hijacking. Include the preload directive and submit your domain to the HSTS preload list for maximum protection.
CSP: Content Security Policy
Content-Security-Policy is the most powerful security header, controlling which resources can load on your pages. Start with a restrictive policy and gradually loosen it as needed. Use report-uri to monitor violations before enforcing.
X-Frame-Options: Clickjacking Prevention
This header prevents your site from being embedded in iframes on malicious sites. Use DENY to prevent all framing or SAMEORIGIN to allow framing only from your own domain. CSP's frame-ancestors directive provides more flexibility.
Testing Security Headers
Use online security header scanners to audit your implementation. Browser DevTools show active headers for any page. Test thoroughly after implementation to ensure normal functionality isn't affected.