Question 1

What are HTTP security headers?

Accepted Answer

HTTP security headers are response headers that instruct browsers on how to handle your site content. They protect against common attacks like XSS (cross-site scripting), clickjacking, MIME sniffing, and man-in-the-middle attacks. Missing security headers are a frequent cause of web application vulnerabilities.

Question 2

What is HSTS (HTTP Strict Transport Security)?

Accepted Answer

HSTS tells browsers to always connect to your site over HTTPS, even if users type "http://". This prevents SSL stripping attacks where an attacker downgrades your HTTPS connection to HTTP. Once a browser sees HSTS, it enforces HTTPS for the duration of the max-age value.

Question 3

What is Content-Security-Policy (CSP)?

Accepted Answer

CSP is a powerful header that restricts which sources of content (scripts, styles, images, etc.) can be loaded on your page. A strict CSP dramatically reduces the risk of XSS attacks by preventing injected scripts from loading resources from attacker-controlled domains.

Question 4

What is X-Frame-Options?

Accepted Answer

X-Frame-Options prevents your site from being embedded in iframes on other domains, protecting users from clickjacking attacks where malicious pages trick users into clicking on hidden elements from your site. Modern sites should use Content-Security-Policy frame-ancestors instead.

Question 5

How do I fix missing security headers?

Accepted Answer

For Next.js, add headers in next.config.ts. For Nginx, add them in the server block. For Apache, use .htaccess or httpd.conf. For Cloudflare, use Transform Rules. CertNotify monitoring can alert you if security headers change or disappear after deployments.

HTTP Header Checker

Frequently Asked Questions