> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/web-application-fundamentals/http-security-headers.md).

# HTTP Security Headers

Security headers are HTTP response headers designed to instruct web browsers on how to manage and protect the content of a website. These headers enhance web application security by mitigating common vulnerabilities.

### **Some commonly used security headers:**

1. **Strict-Transport-Security (HSTS)**: Informs browsers that the site should only be accessed via HTTPS, and any future attempts to access it via HTTP should automatically be redirected to HTTPS.
2. **Content-Security-Policy (CSP)**: Specifies trusted sources for content such as scripts, stylesheets, and other resources. CSP helps prevent cross-site scripting (XSS) and data injection attacks by restricting the loading of untrusted content.
3. **X-Frame-Options**: Protects against clickjacking attacks by controlling whether a web page can be embedded in an iframe on another domain. It prevents unauthorized framing and UI redressing attacks.
4. **X-XSS-Protection**: Enables or configures the browser's built-in XSS protection mechanism. This header helps detect and block malicious scripts, reducing the risk of cross-site scripting (XSS) attacks.
5. **X-Content-Type-Options**: Prevents MIME-type sniffing, ensuring that the browser does not override the declared content type of a resource. This helps protect against content spoofing.
6. **Referrer-Policy**: Controls the amount of referrer information sent with requests when a user navigates between websites. This header helps protect user privacy by limiting the referrer data shared with external websites.

### Resources

{% embed url="<https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers>" %}