HTTP Security Headers Reference

Forces HTTPS for a fixed period. The one header where a careless value can take a domain offline for months.

The most powerful and most misconfigured security header. Most deployed policies provide no XSS protection at all.

One value, one line, no downside worth mentioning. Stops browsers second-guessing your Content-Type.

Blocks framing to prevent clickjacking. Superseded by CSP frame-ancestors, but still worth sending.

Severs the link between your page and windows that opened it. Required for cross-origin isolation — and it breaks popup flows.

Requires every cross-origin resource to opt in. The second half of cross-origin isolation, and the expensive half.

Declares who may load your resources at all. Blocks side-channel reads that CORS does not cover.

Controls how much of your URL is sent to other sites. The default leaks more than most teams expect.

Declares which browser features your page and its frames may use. Syntax changed from Feature-Policy; most copy-pasted examples are wrong.

Obsolete. No current browser implements it, and the filter it enabled was itself exploitable.