HTTP Security Headers Reference
Search or browse common HTTP security headers and what each one protects against.
Content-Security-Policy
Restricts which scripts, styles, and resources a page may load — the main defense against XSS.
Strict-Transport-Security
Forces browsers to only connect over HTTPS for a specified duration, preventing downgrade attacks.
X-Content-Type-Options
Set to nosniff to stop browsers from MIME-sniffing a response away from its declared content type.
X-Frame-Options
Controls whether a page can be embedded in an iframe, preventing clickjacking (superseded by CSP's frame-ancestors).
Referrer-Policy
Controls how much referrer information is sent when navigating away from a page.
Permissions-Policy
Controls which browser features (camera, microphone, geolocation, etc.) a page and its iframes can use.
X-XSS-Protection
Legacy header for browser XSS filters — deprecated in modern browsers in favor of CSP.
Cross-Origin-Opener-Policy
Isolates a page's browsing context from cross-origin windows, mitigating certain side-channel attacks.
Cross-Origin-Resource-Policy
Controls which origins can embed a given resource, protecting against speculative side-channel attacks.
Use the CSP header generator on this site to build a Content-Security-Policy value.
How to use this tool
- 1Filter by header name.
- 2Read what each header does.
Frequently asked questions
Which header should I start with?+
Content-Security-Policy and Strict-Transport-Security are generally the highest-impact headers to add first.