HTTP security headers

What each header does, the value to start with, and how to add it on your platform.

Strict-Transport-Security

HSTS tells browsers to only ever connect to your site over HTTPS for the given time, even if someone types http:// or follows an old link.

CSP tells the browser which sources of scripts, styles, images and frames are allowed on your pages.

X-Frame-Options controls whether other sites can show your pages inside a frame or iframe.

This header stops browsers from guessing (sniffing) a file's type and makes them respect the Content-Type you send.

Referrer-Policy controls how much of the current URL is sent in the Referer header when users follow links or load resources.

Permissions-Policy turns browser features such as camera, microphone and geolocation on or off for your site and any embedded frames.

COOP isolates your page's browsing context from cross-origin windows it opens or that open it.

CORP lets you say which origins may load your resources, such as images and scripts.